Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
21/01/2026, 07:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe
Resource
win11-20251231-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe
- Size 4.6MB
- Sample260121-jhlgyscv4e
- SHA256 f13f1936bdddd42207e7fb7b90766a5d6a788ebf2e57868007259f791c4bb410
- MD5 cf49124fa893e8ac5a44226e91501417
- SHA1 1cb9ced5b5cfb0d564a1def417e0b22a7576fe8a
- SHA512 6b2385e2cd48d26b8df6f1d11608c8825733db96527e520555d499ddb6c2e12042f3512406d9d38efab1bad126321f6c3e0f42a16c5dc9cdfef89172e70cf9c0
- SSDEEP 49152:376gjoYS1YZpWxffgUqLLdV0k/kwxo9/RebAA0pAWz6B/6ATeRWygO/:37f5tNL
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.83.130.138:6666
-
47.83.130.138:8888
-
127.0.0.1:80
Attributes
-
campaign_date
2026. 1.21
Signatures
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Executes dropped EXE 1 IoCs
pid Process 1652 Fort Lauderdale real estate_64.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Fort Lauderdale real estate_64.exe File opened (read-only) \??\E: Fort Lauderdale real estate_64.exe File opened (read-only) \??\M: Fort Lauderdale real estate_64.exe File opened (read-only) \??\O: Fort Lauderdale real estate_64.exe File opened (read-only) \??\P: Fort Lauderdale real estate_64.exe File opened (read-only) \??\R: Fort Lauderdale real estate_64.exe File opened (read-only) \??\S: Fort Lauderdale real estate_64.exe File opened (read-only) \??\W: Fort Lauderdale real estate_64.exe File opened (read-only) \??\B: Fort Lauderdale real estate_64.exe File opened (read-only) \??\I: Fort Lauderdale real estate_64.exe File opened (read-only) \??\N: Fort Lauderdale real estate_64.exe File opened (read-only) \??\Q: Fort Lauderdale real estate_64.exe File opened (read-only) \??\T: Fort Lauderdale real estate_64.exe File opened (read-only) \??\U: Fort Lauderdale real estate_64.exe File opened (read-only) \??\Z: Fort Lauderdale real estate_64.exe File opened (read-only) \??\G: Fort Lauderdale real estate_64.exe File opened (read-only) \??\J: Fort Lauderdale real estate_64.exe File opened (read-only) \??\H: Fort Lauderdale real estate_64.exe File opened (read-only) \??\K: Fort Lauderdale real estate_64.exe File opened (read-only) \??\L: Fort Lauderdale real estate_64.exe File opened (read-only) \??\V: Fort Lauderdale real estate_64.exe File opened (read-only) \??\X: Fort Lauderdale real estate_64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe 1652 Fort Lauderdale real estate_64.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2880 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 79 PID 2196 wrote to memory of 3100 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 80 PID 2196 wrote to memory of 3828 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 81 PID 2196 wrote to memory of 3524 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 82 PID 2196 wrote to memory of 5484 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 83 PID 2196 wrote to memory of 3912 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 84 PID 2196 wrote to memory of 1852 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 85 PID 2196 wrote to memory of 1652 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 93 PID 2196 wrote to memory of 4848 2196 2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-01-21_cf49124fa893e8ac5a44226e91501417_frostygoop_glassworm_knight_luca-stealer_salatstealer_sliver_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\WhatsApp Image 2026-01-18 at 08.56.43 (1).jpeg"2⤵PID:2880
-
-
C:\Windows\system32\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\WhatsApp Image 2026-01-18 at 08.56.43.jpeg"2⤵PID:3100
-
-
C:\Windows\system32\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\WhatsApp Image 2026-01-20 at 12.19.18.jpeg"2⤵PID:3828
-
-
C:\Windows\system32\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\WhatsApp Image 2026-01-18 at 08.56.46.jpeg"2⤵PID:3524
-
-
C:\Windows\system32\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\WhatsApp Image 2026-01-18 at 08.56.45.jpeg"2⤵PID:5484
-
-
C:\Windows\system32\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\WhatsApp Image 2026-01-18 at 08.56.44 (1).jpeg"2⤵PID:3912
-
-
C:\Windows\system32\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\WhatsApp Image 2026-01-18 at 08.56.44.jpeg"2⤵PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\Fort Lauderdale real estate_64.exe"C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\Fort Lauderdale real estate_64.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Windows\system32\cmd.execmd /c start "" C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\favicon.ico2⤵PID:4848
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ifj670b16txp\Fort Lauderdale real estate_64.exe
- Size 129KB
- SHA256 7a458b4d3396ee5fdf65146ffb4f1575885e7138368685526ea618ecbc9a3706
- MD5 5f4dcf3025b50e6b319e6d3f41819fab
- SHA1 de83764d2ebcd52f3350c7887d82feb9e12f14ef
- SHA512 254ffd65ec7373631b62285159147e328a3e606f8d4463b59e10c16ff4fd064b8ca0870efe89efb1409a9ede28a54967a2cdfb94f71582302bcb5fb9df5c5c32
- SSDEEP 3072:CkEOSO65mF9xns+YsDjT4ZQcIhkpNzGbq4/WD5FbsPjelxIU3ezoQ:CkEJ5YcgT4ZuhkpNibq4+VyPQlPQ
- TLSH T153D36C4733A460F9D4678279C9A24A06E7B374620775A7CF13B086A66F137D1BE3A331
- MD5 SHA1 SHA512 SSDEEP TLSH