Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
29/11/2025, 03:16
General
- Target 2025-11-29_a551063781114617933c1ac7f8d9f9f6_amadey_coinminer_darkgate_elex_glassworm_hijackloader_revil_smoke-loader.exe
- Size 37.7MB
- Sample251129-dsm6mszphs
- SHA256 e7cce21cd65b21648155456fc7543bf0fafb3009e3d0289626712e671d4b2df1
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
www.tfuuuk.com:80
-
www.tfuuuk.com:443
-
campaign_date
MT5-MT5
Signatures
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 9 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-11-29_a551063781114617933c1ac7f8d9f9f6_amadey_coinminer_darkgate_elex_glassworm_hijackloader_revil_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-11-29_a551063781114617933c1ac7f8d9f9f6_amadey_coinminer_darkgate_elex_glassworm_hijackloader_revil_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ZRYLHDVZ8G.tmp\2025-11-29_a551063781114617933c1ac7f8d9f9f6_amadey_coinminer_darkgate_elex_glassworm_hijackloader_revil_smoke-loader.tmp"C:\Users\Admin\AppData\Local\Temp\is-ZRYLHDVZ8G.tmp\2025-11-29_a551063781114617933c1ac7f8d9f9f6_amadey_coinminer_darkgate_elex_glassworm_hijackloader_revil_smoke-loader.tmp" /SL5="$50316,38149348,902144,C:\Users\Admin\AppData\Local\Temp\2025-11-29_a551063781114617933c1ac7f8d9f9f6_amadey_coinminer_darkgate_elex_glassworm_hijackloader_revil_smoke-loader.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" netsh advfirewall set allprofiles state off3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" schtasks /create /rl HIGHEST /sc ONLOGON /tn "vlrqbj" /tr "'C:\ProgramData\vlrqbj\Client.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /rl HIGHEST /sc ONLOGON /tn vlrqbj /tr C:\ProgramData\vlrqbj\Client.exe4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\ProgramData\vlrqbj\exness5setup.exe"C:\ProgramData\vlrqbj\exness5setup.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\vlrqbj\Client.exe"C:\ProgramData\vlrqbj\Client.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\vlrqbj\app-3.16.4\Client.exe"C:\ProgramData\vlrqbj\app-3.16.4\Client.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\ProgramData\vlrqbj\Client.exeC:\ProgramData\vlrqbj\Client.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\vlrqbj\app-3.16.4\Client.exe"C:\ProgramData\vlrqbj\app-3.16.4\Client.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe
Client.exe
libcrypto.dll
libcurl.dll
msvcp100.dll
msvcr100.dll
user.bak
exness5setup.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mskwp4jb.s1q.ps1
_setup64.tmp
2025-11-29_a551063781114617933c1ac7f8d9f9f6_amadey_coinminer_darkgate_elex_glassworm_hijackloader_revil_smoke-loader.tmp
memory/2568-37-0x00000278FDB00000-0x00000278FDB22000-memory.dmp
memory/3136-95-0x00000000004B0000-0x000000000059C000-memory.dmp
memory/3136-0-0x00000000004B0000-0x000000000059C000-memory.dmp
memory/3136-99-0x00000000004B0000-0x000000000059C000-memory.dmp
memory/3720-5-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/3720-98-0x0000000000F30000-0x0000000001384000-memory.dmp
memory/3720-96-0x0000000000F30000-0x0000000001384000-memory.dmp
memory/3720-97-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/5532-50-0x00007FF80B290000-0x00007FF80B292000-memory.dmp
memory/5532-51-0x00007FF760E00000-0x00007FF76199B000-memory.dmp
memory/6060-80-0x0000000002B70000-0x000000000426F000-memory.dmp
memory/6060-106-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-83-0x0000000002B70000-0x000000000426F000-memory.dmp
memory/6060-85-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-81-0x0000000002B70000-0x000000000426F000-memory.dmp
memory/6060-84-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-100-0x00000000738E0000-0x0000000073C87000-memory.dmp
memory/6060-86-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-107-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-108-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-109-0x00000000738E0000-0x0000000073C87000-memory.dmp
memory/6060-111-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-119-0x0000000007260000-0x00000000073DB000-memory.dmp
memory/6060-121-0x0000000007260000-0x00000000073DB000-memory.dmp