Analysis
- max time kernel
150s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
26/06/2025, 14:26
General
- Target 4fb3c8bd5373ca31f1f8b37e64c31ef0.exe
- Size 1.6MB
- Sample250626-rr9vxaej7z
- SHA256 96042249d20ca53e1238e6d27af7e8d8ce61d7ccde6fb17ea83f2b43420df758
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
206.238.196.177:55131
-
8.217.38.238:8888
-
206.238.196.177:55132
-
206.238.115.30:55231
-
206.238.115.30:55232
Signatures
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Delays execution with timeout.exe 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fb3c8bd5373ca31f1f8b37e64c31ef0.exe"C:\Users\Admin\AppData\Local\Temp\4fb3c8bd5373ca31f1f8b37e64c31ef0.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c "cmd /c timeout /T 5 & del /ah /Q "C:\Users\Admin\AppData\Local\Temp\WcBoLQiYuj.sys""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c timeout /T 53⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /T 54⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "cmd /c timeout /T 5 & del /ah /Q "C:\Users\Admin\AppData\Local\Temp\4fb3c8bd5373ca31f1f8b37e64c31ef0.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c timeout /T 53⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /T 54⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Program Files\RunTime\RuntimeBroker.exe"C:\Program Files\RunTime\RuntimeBroker.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\RunTime\RuntimeBroker.exe"C:\Program Files\RunTime\RuntimeBroker.exe" start1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Amsdk_Service.sys
RuntimeBroker.exe
json[1].json
memory/700-16-0x00007FF6045D0000-0x00007FF604A6F000-memory.dmp
memory/700-6-0x00007FF6045D0000-0x00007FF604A6F000-memory.dmp
memory/3376-32-0x000002106AB50000-0x000002106AB7D000-memory.dmp
memory/3376-30-0x000002106AB00000-0x000002106AB2D000-memory.dmp
memory/3376-11-0x00007FF6045D0000-0x00007FF604A6F000-memory.dmp
memory/3376-50-0x000002106AB50000-0x000002106AB7D000-memory.dmp
memory/3376-21-0x00007FF6045D0000-0x00007FF604A6F000-memory.dmp
memory/3376-23-0x000002106AB00000-0x000002106AB2D000-memory.dmp
memory/3376-24-0x000002106AB00000-0x000002106AB2D000-memory.dmp
memory/3376-27-0x000002106AB50000-0x000002106AB7D000-memory.dmp
memory/3376-26-0x000002106AB50000-0x000002106AB7D000-memory.dmp
memory/3376-28-0x00007FF6045D0000-0x00007FF604A6F000-memory.dmp
memory/3376-29-0x000002106AB00000-0x000002106AB2D000-memory.dmp
memory/3376-49-0x000002106AB50000-0x000002106AB7D000-memory.dmp
memory/3376-31-0x000002106AB50000-0x000002106AB7D000-memory.dmp
memory/3376-47-0x000002106CF80000-0x000002106CFCD000-memory.dmp
memory/3376-33-0x000002106AB00000-0x000002106AB2D000-memory.dmp
memory/3376-34-0x000002106C600000-0x000002106C64D000-memory.dmp
memory/3376-36-0x000002106C600000-0x000002106C64D000-memory.dmp
memory/3376-40-0x000002106C600000-0x000002106C64D000-memory.dmp
memory/3376-39-0x000002106C600000-0x000002106C64D000-memory.dmp
memory/3376-41-0x000002106AB50000-0x000002106AB7D000-memory.dmp
memory/3376-42-0x000002106CF80000-0x000002106CFCD000-memory.dmp
memory/3376-44-0x000002106CF80000-0x000002106CFCD000-memory.dmp
memory/3376-45-0x000002106AB00000-0x000002106AB2D000-memory.dmp
memory/3376-46-0x000002106AB00000-0x000002106AB2D000-memory.dmp
memory/3376-48-0x000002106CF80000-0x000002106CFCD000-memory.dmp
memory/3664-14-0x00007FF706AF0000-0x00007FF706F8F000-memory.dmp
memory/3664-0-0x00007FF706AF0000-0x00007FF706F8F000-memory.dmp
memory/3664-9-0x00007FF706AF0000-0x00007FF706F8F000-memory.dmp