Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/02/2026, 07:50
General
- Target 13433E435060376939019BA6AEB1F079.exe
- Size 8.0MB
- Sample260220-jpfkaaez7e
- SHA256 ce84659bf96dbdf2560f7c96518ee6ae1a8c2ff55ede4e79457c12f248c2909a
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
45.207.199.73:10801
-
127.0.0.1:80
-
campaign_date
2026. 2.16
Signatures
- Detects ValleyRAT payload 7 IoCs
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13433E435060376939019BA6AEB1F079.exe"C:\Users\Admin\AppData\Local\Temp\13433E435060376939019BA6AEB1F079.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c start "" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\13433E435060376939019BA6AEB1F079.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\13433E435060376939019BA6AEB1F079.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\13433E435060376939019BA6AEB1F079.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c start "" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\13433E435060376939019BA6AEB1F079.exe /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\13433E435060376939019BA6AEB1F079.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\13433E435060376939019BA6AEB1F079.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
13433E435060376939019BA6AEB1F079.exe
Defender.exe
Defender.ini
memory/2540-19-0x00000000243D0000-0x0000000024402000-memory.dmp
memory/2540-20-0x0000000024550000-0x0000000024588000-memory.dmp
memory/2540-14-0x0000000022230000-0x0000000022252000-memory.dmp
memory/2540-15-0x0000000022230000-0x0000000022252000-memory.dmp
memory/2540-17-0x0000000022230000-0x0000000022252000-memory.dmp
memory/2540-16-0x0000000022230000-0x0000000022252000-memory.dmp
memory/2540-18-0x0000000022230000-0x0000000022252000-memory.dmp
memory/2540-10-0x0000000001BF0000-0x0000000001BF1000-memory.dmp
memory/2540-21-0x0000000024550000-0x0000000024588000-memory.dmp
memory/2540-13-0x00000000221A0000-0x0000000022221000-memory.dmp
memory/2540-22-0x0000000024550000-0x0000000024588000-memory.dmp
memory/2540-23-0x0000000024550000-0x0000000024588000-memory.dmp
memory/2540-24-0x0000000024550000-0x0000000024588000-memory.dmp
memory/2540-25-0x0000000022230000-0x0000000022252000-memory.dmp
memory/2540-26-0x0000000022230000-0x0000000022252000-memory.dmp
memory/2540-29-0x0000000023A10000-0x0000000023AD2000-memory.dmp
memory/2540-30-0x0000000024550000-0x0000000024588000-memory.dmp
memory/2540-37-0x0000000023A10000-0x0000000023AD2000-memory.dmp