valleyrat_s2 | e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
09/12/2025, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe
Size 2.0MB
Sample251209-fp8dhstpfz
SHA256 e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100
MD5 f375ed6becbcd87195cffb639f1eb11f
SHA1 1166914761817e87f2789b10d3b2937a9f57a4a1
SHA512 65d2e00c0ce629f35b721761702837daf26d3134654024880225251e8deb1f9fc1145e5b34108de28fd62399b5edfac7dceae0df6ad27bf4c7d4a4607dd0de37
SSDEEP 24576:T5puG56lBHn/Ik5rFWIwTQTOu9u0IEOluF40GlkMIINCCNLRN:Tvuc6lF/IQWpQVAlzH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor defense_evasion discovery valleyrat_s2 persistence ransomware

Malware Config

Extracted

Family

valleyrat_s2

Version

2025.12.3

154.39.66.21:443
154.39.66.21:447
154.39.66.21:446

Attributes

campaign_date
2025.12.3

Signatures

ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	windowas.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	windowas.exe

Executes dropped EXE 1 IoCs

pid	Process
5344	windowas.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowas.exe = "C:\\Program Files\\winaknf\\windowas.exe"	reg.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	tracerpt.exe
File opened (read-only)	\??\J:	tracerpt.exe
File opened (read-only)	\??\Q:	tracerpt.exe
File opened (read-only)	\??\X:	tracerpt.exe
File opened (read-only)	\??\E:	tracerpt.exe
File opened (read-only)	\??\I:	tracerpt.exe
File opened (read-only)	\??\K:	tracerpt.exe
File opened (read-only)	\??\M:	tracerpt.exe
File opened (read-only)	\??\N:	tracerpt.exe
File opened (read-only)	\??\R:	tracerpt.exe
File opened (read-only)	\??\S:	tracerpt.exe
File opened (read-only)	\??\V:	tracerpt.exe
File opened (read-only)	\??\B:	tracerpt.exe
File opened (read-only)	\??\G:	tracerpt.exe
File opened (read-only)	\??\O:	tracerpt.exe
File opened (read-only)	\??\W:	tracerpt.exe
File opened (read-only)	\??\Y:	tracerpt.exe
File opened (read-only)	\??\Z:	tracerpt.exe
File opened (read-only)	\??\L:	tracerpt.exe
File opened (read-only)	\??\P:	tracerpt.exe
File opened (read-only)	\??\T:	tracerpt.exe
File opened (read-only)	\??\U:	tracerpt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5344 set thread context of 4680	5344	windowas.exe	95

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\winaknf\windowas.exe	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe
File opened for modification	C:\Program Files\winaknf\windowas.exe	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000_Classes\aea8b74d3595cec77ff6e6eda7fe1b8e	tracerpt.exe
Key created	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000_Classes\aea8b74d3595cec77ff6e6eda7fe1b8e\0	tracerpt.exe
Key created	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000_Classes\aea8b74d3595cec77ff6e6eda7fe1b8e\1	tracerpt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000_Classes\aea8b74d3595cec77ff6e6eda7fe1b8e\i = "1765256683"	tracerpt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1644934582-3155071241-5924616-1000\{6FEF8EDD-A978-47F5-802E-7BE68500B284}	tracerpt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1644934582-3155071241-5924616-1000\{604A819E-B009-476E-9EE2-A4454DA24E52}	tracerpt.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe
4680	tracerpt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4680	tracerpt.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1620	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	78
PID 2720 wrote to memory of 1032	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	80
PID 2720 wrote to memory of 5736	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	82
PID 2720 wrote to memory of 1908	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	84
PID 2720 wrote to memory of 1816	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	86
PID 2720 wrote to memory of 5032	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	87
PID 2720 wrote to memory of 5584	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	90
PID 2720 wrote to memory of 4968	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	92
PID 2720 wrote to memory of 5344	2720	e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe	94
PID 5344 wrote to memory of 4680	5344	windowas.exe	95
PID 5344 wrote to memory of 4680	5344	windowas.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe
"C:\Users\Admin\AppData\Local\Temp\e0bd2220e7b9b49cfa461112fb65d234a8d8b50cf15d392e679de1f79e390100.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winaknf" /f /v "Publisher" /d "winaknf"
  2⤵
  PID:1620
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winaknf" /f /v "Comments" /d "加群更新"
  2⤵
  PID:1032
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winaknf" /f /v "HelpLink" /d "https://qm.qq.com/q/mRqkhMmvyo"
  2⤵
  PID:5736
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winaknf" /f /v "DisplayName" /d "winaknf"
  2⤵
  PID:1908
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winaknf" /f /v "DisplayVersion" /d "1.0.0.0"
  2⤵
  PID:1816
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winaknf" /f /v "EstimatedSize" /t REG_DWORD /d "1967"
  2⤵
  PID:5032
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winaknf" /f /v "DisplayIcon" /d "C:\Program Files\winaknf\windowas.exe"
  2⤵
  PID:5584
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "windowas.exe" /t REG_SZ /d "C:\Program Files\winaknf\windowas.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4968
- C:\Program Files\winaknf\windowas.exe
  "C:\Program Files\winaknf\windowas.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\System32\tracerpt.exe
    "C:\Windows\System32\tracerpt.exe"
    3⤵
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windowas.exe

Path C:\Program Files\winaknf\windowas.exe
Size 1.9MB
SHA256 7fcd2ec2ecfe6bba4e09423b7a7c9d823af816eaffa15f58879d105da0725337
MD5 5b31bf68485af4b4eaee089da2866e91
SHA1 78ba0c932b81c6c1fbe590ac4abce3e1ead743e2
SHA512 53e23385c06c2b4a4dde59e6b208f639d8d4913712e1b65f6fa3b1cf4f7efa143eb1bc175d5bf4eb2a6573430dde2dd1283f90716be420e2ef5bc2b7a7960e4f
SSDEEP 24576:I6lBHn/Ik5rFWIwTQTOu9u0IEOluF40GlkMIINCCNLR:I6lF/IQWpQVAlz
MD5 SHA1 SHA512 SSDEEP

Submit Download

2385.exe

Path C:\Users\Admin\AppData\Local\Temp\2385.exe
Size 14KB
SHA256 4b9288b31e98cbe44957b5006de964edf62cc5ace6c04d75e0993ca74cf2e53d
MD5 a7557aada4bd26eee59970cf2513385e
SHA1 5ca2ef5046be8e3639e300236ab6e1bcb6947bd7
SHA512 c9a90e01cb715c3e6389f4c0451107e02e6aa05af5e7b34e929933b0b3af4479248f3fa3a3ac269e710e57dd66c3b881fb7ed9b0cd800359fa841824962a093f
SSDEEP 192:8r5VQs6CuvORmXAl5dtPmxD1mLwLSd8CHEhldFyaW+mLD4W7vaMCgUCNy9mLGxXf:8H6DvlWTPKDULwE1E3SD4ziE9/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4680-33-0x0000022054FE0000-0x0000022055032000-memory.dmp

Download

memory/4680-31-0x0000022054FE0000-0x0000022055032000-memory.dmp

Download

memory/4680-40-0x0000022054FE0000-0x0000022055032000-memory.dmp

Download

memory/4680-41-0x0000022054FE0000-0x0000022055032000-memory.dmp

Download

memory/4680-35-0x0000022054FE0000-0x0000022055032000-memory.dmp

Download

memory/4680-32-0x0000022054FE0000-0x0000022055032000-memory.dmp

Download

memory/4680-28-0x0000022054FE0000-0x0000022055032000-memory.dmp

Download

memory/5344-29-0x0000023962B70000-0x0000023962B9D000-memory.dmp

Download

memory/5344-30-0x0000023962B70000-0x0000023962B9D000-memory.dmp

Download

memory/5344-20-0x0000023962B70000-0x0000023962B9D000-memory.dmp

Download

memory/5344-18-0x0000023962AD0000-0x0000023962AFD000-memory.dmp

Download

memory/5344-27-0x0000023962B70000-0x0000023962B9D000-memory.dmp

Download

memory/5344-24-0x0000023962B70000-0x0000023962B9D000-memory.dmp

Download

memory/5344-22-0x0000023962B70000-0x0000023962B9D000-memory.dmp

Download

memory/5344-21-0x0000023962B70000-0x0000023962B9D000-memory.dmp

Download