valleyrat_s2 | b9e7372c4b67c96e74079a4680ca52bfd4fcebac88cc4a475c3ea9a5898a08b2

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
配置清单.msi
Size 2.3MB
Sample260106-kntk7afs8a
SHA256 adfc8fbe77044af27b8b6ce901c384d786e1a34124ece6cb743f3a5c7a4d303e
MD5 93a10bdfec266a8deada0d6f7b294d06
SHA1 7ba97a13d1842e8ca51c92b9b23b273a97191252
SHA512 2069ef3ff74bcfd633bb761af180f30a7ad27a1f63172d7068f5f2767242210c5b5e72047fb70e02b6d0c50151db50196caec7ff2625aac0449c39f99a117acd
SSDEEP 49152:9ueB+TEanLBm/usqOVX7Gp7ADREFClUDxuj45G178g46CPT6RQgo:YyX0lFC2YovPT6RY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor defense_evasion discovery valleyrat_s2 persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

valleyrat_s2

Version

154.23.127.134:1688
127.0.0.1:80

Attributes

campaign_date
2025. 8.17

Signatures

Detects ValleyRAT payload 8 IoCs

resource	yara_rule
behavioral2/memory/5924-55-0x0000000003330000-0x0000000003381000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4000-57-0x0000000002AE0000-0x0000000002B31000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5924-58-0x0000000003330000-0x0000000003381000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5924-59-0x0000000003330000-0x0000000003381000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5924-60-0x0000000003330000-0x0000000003381000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4000-63-0x0000000002AE0000-0x0000000002B31000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4000-64-0x0000000002AE0000-0x0000000002B31000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4000-65-0x0000000002AE0000-0x0000000002B31000-memory.dmp	family_valleyrat_stage_2_v2

ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4000	rundll32.exe
4	5924	rundll32.exe
5	4000	rundll32.exe
6	5924	rundll32.exe
7	5924	rundll32.exe
8	4000	rundll32.exe

Executes dropped EXE 4 IoCs

pid	Process
5276	MSI214.tmp
1212	temp.exe
3256	cc.exe
4204	temp.exe

Loads dropped DLL 5 IoCs

pid	Process
1468	MsiExec.exe
1468	MsiExec.exe
1468	MsiExec.exe
1468	MsiExec.exe
1468	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFD5B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA07D0124D0F34B2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI119.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI214.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F4AF2E0721277F7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF52E0CFC7791DD436.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1137D530E033574D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fccf.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFC0.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57fccf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEE3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{64F89CF8-5B3A-46B6-B61B-831D256FC467}	msiexec.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
5276	MSI214.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4876	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI214.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006bf41c171266c7620000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006bf41c170000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809006bf41c17000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a6bf41c17000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6bf41c17000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	1	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4756	msiexec.exe
4756	msiexec.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe
5924	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5924	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4876	msiexec.exe
Token: SeSecurityPrivilege	4756	msiexec.exe
Token: SeCreateTokenPrivilege	4876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4876	msiexec.exe
Token: SeLockMemoryPrivilege	4876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4876	msiexec.exe
Token: SeMachineAccountPrivilege	4876	msiexec.exe
Token: SeTcbPrivilege	4876	msiexec.exe
Token: SeSecurityPrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeLoadDriverPrivilege	4876	msiexec.exe
Token: SeSystemProfilePrivilege	4876	msiexec.exe
Token: SeSystemtimePrivilege	4876	msiexec.exe
Token: SeProfSingleProcessPrivilege	4876	msiexec.exe
Token: SeIncBasePriorityPrivilege	4876	msiexec.exe
Token: SeCreatePagefilePrivilege	4876	msiexec.exe
Token: SeCreatePermanentPrivilege	4876	msiexec.exe
Token: SeBackupPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeShutdownPrivilege	4876	msiexec.exe
Token: SeDebugPrivilege	4876	msiexec.exe
Token: SeAuditPrivilege	4876	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4876	msiexec.exe
Token: SeChangeNotifyPrivilege	4876	msiexec.exe
Token: SeRemoteShutdownPrivilege	4876	msiexec.exe
Token: SeUndockPrivilege	4876	msiexec.exe
Token: SeSyncAgentPrivilege	4876	msiexec.exe
Token: SeEnableDelegationPrivilege	4876	msiexec.exe
Token: SeManageVolumePrivilege	4876	msiexec.exe
Token: SeImpersonatePrivilege	4876	msiexec.exe
Token: SeCreateGlobalPrivilege	4876	msiexec.exe
Token: SeBackupPrivilege	2312	vssvc.exe
Token: SeRestorePrivilege	2312	vssvc.exe
Token: SeAuditPrivilege	2312	vssvc.exe
Token: SeBackupPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeRestorePrivilege	4756	msiexec.exe
Token: SeTakeOwnershipPrivilege	4756	msiexec.exe
Token: SeBackupPrivilege	5112	srtasks.exe
Token: SeRestorePrivilege	5112	srtasks.exe
Token: SeSecurityPrivilege	5112	srtasks.exe
Token: SeTakeOwnershipPrivilege	5112	srtasks.exe
Token: SeBackupPrivilege	5112	srtasks.exe
Token: SeRestorePrivilege	5112	srtasks.exe
Token: SeSecurityPrivilege	5112	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4876	msiexec.exe
4876	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5924	rundll32.exe
4000	rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 5112	4756	msiexec.exe	81
PID 4756 wrote to memory of 1468	4756	msiexec.exe	83
PID 4756 wrote to memory of 5276	4756	msiexec.exe	84
PID 5276 wrote to memory of 2124	5276	MSI214.tmp	85
PID 2124 wrote to memory of 1212	2124	cmd.exe	87
PID 2124 wrote to memory of 3256	2124	cmd.exe	88
PID 1212 wrote to memory of 4000	1212	temp.exe	89
PID 1212 wrote to memory of 4000	1212	temp.exe	89
PID 4204 wrote to memory of 5924	4204	temp.exe	92
PID 4204 wrote to memory of 5924	4204	temp.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\配置清单.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4876

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 680041E60054F9F45D6D320225D50BC6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1468
- C:\Windows\Installer\MSI214.tmp
  "C:\Windows\Installer\MSI214.tmp" /RunAsAdmin /HideWindow cmd /c start C:\Users\Public\403\temp.exe&copy C:\Windows\System32\schtasks.exe C:\Users\Public\403\cc.exe&C:\Users\Public\403\cc.exe /create /sc onlogon /tn Tahk /rl highest /tr "C:\Users\Public\403\temp.exe" /F
  2⤵
  - Executes dropped EXE
  - Access Token Manipulation: Create Process with Token
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\403\temp.exe&copy C:\Windows\System32\schtasks.exe C:\Users\Public\403\cc.exe&C:\Users\Public\403\cc.exe /create /sc onlogon /tn Tahk /rl highest /tr "C:\Users\Public\403\temp.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Users\Public\403\temp.exe
      C:\Users\Public\403\temp.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe"
        5⤵
        Badlisted process makes network request
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4000
  - - C:\Users\Public\403\cc.exe
      C:\Users\Public\403\cc.exe /create /sc onlogon /tn Tahk /rl highest /tr "C:\Users\Public\403\temp.exe" /F
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Users\Public\403\temp.exe
C:\Users\Public\403\temp.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57fcd2.rbs

Path C:\Config.Msi\e57fcd2.rbs
Size 416KB
SHA256 e02211d00f6b731575c8fbdba7cb186f38b9078e57eb4bee782bce671a2cce01
MD5 080c23656b496255753a71e4758b438c
SHA1 853622c12f248854e39d43ab1b75931dd11019b9
SHA512 5f1550421ac0856fc6a66e85dbb0f2b47d82e65da44f725922b4300f01a9d2f39ddd53cc9581e7144651d15e889fb766ea4f9f7625f1d38e2c6637143fbf1c60
SSDEEP 12288:KmtED0AgAMc0JR4nLBm/usqsuKXQZCV/UwHo+GHJD:KiEYAgAMcEanLBm/usqsECVcw7GHJD
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.exe

Path C:\Users\Public\403\cc.exe
Size 197KB
SHA256 994cd15250e0b7310c26b9c5f58b37d0a1092b1582b8d0f084d75161779d5520
MD5 f37cbafef5b8d109890fed78f1d7fc4d
SHA1 2b6334c5a7b7f104627c4ff7d2e7a0138168a520
SHA512 3c0b6c64abec35e17ae5e9351768e78dcd7275eb7bb8e3f4ad9b1d0c1625ce8d9904029754ef7c2c645a1ffac30de8817f638088255678e8918ba95d4911ebcd
SSDEEP 3072:q+A0HuN1LqLbuq6V90179qQ1pyisDHpDRQcDa54z0ZFUBateq6xR:qWuN18qPVK1BHP6pRQcDE4oZFUebuR
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.ahk

Path C:\Users\Public\403\temp.ahk
Size 3KB
SHA256 61c94e01f3381540da024222aaa7307ddad68fda2420077ce28b8e92e5b2a3cb
MD5 5e8957151b5e4021c769ab6968d2503b
SHA1 f92dd29fae1b677bac03b481cc839f9a6cfd640f
SHA512 26338e001ac14953db407b1b6ac38be3f3be4f03dada154bc851025f1b795f2d1afc6c37ed799be0becc0e7b232f882c8595c4041bc84c27916d4115abe0f683
MD5 SHA1 SHA512

Submit Download

temp.exe

Path C:\Users\Public\403\temp.exe
Size 955KB
SHA256 e0464215b4d096fa0b27cd34d5e6b15dd6ea7f71a9bce837938a23fd7c8beb36
MD5 564c4e3d2bf76b70a41596fee7c209eb
SHA1 1b19eda50322847339d29da83741ceac84587063
SHA512 fdbf5934bf55d3cf42a604dabf61a57bcfd92725cc32eb4331953f49fee0f25016aeda0f7b84ca5a52fcc4ddfae9afa22acd18d468b9317f76461834c1ef72f7
SSDEEP 24576:bvWR+MeT/2/7dG/kvn/QBPU8A8uiVlasEI3G7c:bOb/+TlasE+G7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Time.txt

Path C:\Users\Public\Documents\Time.txt
Size 19B
SHA256 84ffd42af911ea9fcc127254eb53933dc1544a80c1e2feb6c952598829e22edc
MD5 eb07bdca07df2915854c9a3336f63220
SHA1 18585a4938f53224aa77d90027167a8be1cbb2a1
SHA512 93ecf21c46b12f7d3e30c848ae9be843abb1cae1195bf78c6772cf03d574733c8b6f1ae429805fae6f62782d2aee994314815c601fd586dd276057ec43d38372
MD5 SHA1 SHA512

Submit Download

MSI214.tmp

Path C:\Windows\Installer\MSI214.tmp
Size 415KB
SHA256 0e86780447edc11025c12d2563097fff93f90f7979ce649c20217791553c4c5a
MD5 070ac1c3aee417a8615b59482ce54703
SHA1 5852b3367b62c3d6b1ac6895dde8e40965dc3aaa
SHA512 34d51c9ce32cb2b88400de6cbefdd6fa38f223afd66aed4a0c8c56c1b01a51ae99ae0f13b990be5f0d4fca8c9f042095aac92b70c0b6c58da1a5cb0fd5961a12
SSDEEP 12288:nmtED0AgAMc0JR4nLBm/usqsuKXQZCV/UwHo+GHJ:niEYAgAMcEanLBm/usqsECVcw7GHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIFD5B.tmp

Path C:\Windows\Installer\MSIFD5B.tmp
Size 1005KB
SHA256 7b3a4e3e3f58fa49164d49b14bc10c13a9d734846956c8a7a433c8bb6c82d983
MD5 0606e1a2fe0d72593405cafeb945c740
SHA1 641e8cfea8d2203d3127b49939b1ed5f1c97dc9e
SHA512 696152be48a1256c5eda545b8759671117a7b55e49723b437b6ee258a3b568b9440f1592e4abf4eb1aa878e960cc721bdbc55f2a48d77bb1b3315b75cc15946a
SSDEEP 24576:uADREF4f3fy4UpBxQnWh0lhSMXlI5G17n:uADREFClUDxuj45G17n
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 7e3b1921ea63bb50fd91af517fab8968e0defd44ad3f2e2f1b9714e68f8cbc6b
MD5 22fb1d3fdc78c5483fa8c75fddb1e6aa
SHA1 36056854f1435cca4c462e241472e7a335ad6764
SHA512 403366e30b08613bb568b8fa1ce70c93058d783035e1e19028015f7435539ec2e56ecfb42868a858612d07b7166ab4c59ec7b60827e5f5f5de9ef373c9f3cc71
SSDEEP 24576:N2gmSpOqdoO/vvTLbmUOh0nqf6pfw4weW2H9XpEk9vaok4AyIfVrLJOzh:t
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3f75d385-90b7-4835-aa1f-ac26af3c21a5}_OnDiskSnapshotProp

Path \??\Volume{171cf46b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3f75d385-90b7-4835-aa1f-ac26af3c21a5}_OnDiskSnapshotProp
Size 6KB
SHA256 36a84b209a6d496c5a687d3b06827e9eb554909e41b54a24ddeafdf3832a31cc
MD5 fd9a9c86a00b6a3c4abd7026afde3fd5
SHA1 7d35ade5e671c3767841689b5ae7a4cd6e2e7e5d
SHA512 1988ded9430db2fd417bd585305929cc2044c387125005c5276dcc3b255dc97c992dbf561a631906595f4905975f8ab52f0d7257906c70f2bbb980055283ae30
SSDEEP 96:FoCBBOmvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Jucb++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4000-48-0x0000000002310000-0x0000000002332000-memory.dmp

Download

memory/4000-50-0x0000000002310000-0x0000000002332000-memory.dmp

Download

memory/4000-73-0x0000000002310000-0x0000000002332000-memory.dmp

Download

memory/4000-72-0x0000000002310000-0x0000000002332000-memory.dmp

Download

memory/4000-51-0x0000000002310000-0x0000000002332000-memory.dmp

Download

memory/4000-56-0x0000000002310000-0x0000000002332000-memory.dmp

Download

memory/4000-57-0x0000000002AE0000-0x0000000002B31000-memory.dmp

Download

memory/4000-65-0x0000000002AE0000-0x0000000002B31000-memory.dmp

Download

memory/4000-64-0x0000000002AE0000-0x0000000002B31000-memory.dmp

Download

memory/4000-63-0x0000000002AE0000-0x0000000002B31000-memory.dmp

Download

memory/4756-47-0x0000013BE6020000-0x0000013BE6AE2000-memory.dmp

Download

memory/5924-55-0x0000000003330000-0x0000000003381000-memory.dmp

Download

memory/5924-49-0x0000000002B50000-0x0000000002B72000-memory.dmp

Download

memory/5924-60-0x0000000003330000-0x0000000003381000-memory.dmp

Download

memory/5924-59-0x0000000003330000-0x0000000003381000-memory.dmp

Download

memory/5924-58-0x0000000003330000-0x0000000003381000-memory.dmp

Download

memory/5924-70-0x0000000002B50000-0x0000000002B72000-memory.dmp

Download

memory/5924-54-0x0000000002B50000-0x0000000002B72000-memory.dmp

Download

memory/5924-53-0x0000000002B50000-0x0000000002B72000-memory.dmp

Download

memory/5924-52-0x0000000002B50000-0x0000000002B72000-memory.dmp

Download