Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/03/2026, 15:50
General
- Target f4c5d60c27d9cb4a45574151e9bc57786a044f44d990f.exe
- Size 761KB
- Sample260301-s92spaav3a
- SHA256 f4c5d60c27d9cb4a45574151e9bc57786a044f44d990f92ea3930fe980d62650
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
111.170.36.160:8585
-
campaign_date
2026. 3. 1
Signatures
- Detects ValleyRAT payload 19 IoCs
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in Program Files directory 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4c5d60c27d9cb4a45574151e9bc57786a044f44d990f.exe"C:\Users\Admin\AppData\Local\Temp\f4c5d60c27d9cb4a45574151e9bc57786a044f44d990f.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\jk\active_desktop_launcher.exe"C:\Program Files (x86)\jk\active_desktop_launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\jk\active_desktop_launcher.exe"C:\Program Files (x86)\jk\active_desktop_launcher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Edge.exe
Microsoft-Edge.exe
active_desktop_launcher.exe
active_desktop_render.dll
memory/2568-26-0x00000000013D0000-0x000000000140F000-memory.dmp
memory/2568-27-0x0000000001430000-0x0000000001488000-memory.dmp
memory/2568-40-0x0000000003350000-0x0000000003396000-memory.dmp
memory/2568-29-0x0000000003350000-0x0000000003396000-memory.dmp
memory/2568-25-0x0000000001430000-0x0000000001488000-memory.dmp
memory/2568-24-0x0000000001430000-0x0000000001488000-memory.dmp
memory/2568-23-0x0000000001430000-0x0000000001488000-memory.dmp
memory/2568-28-0x0000000003350000-0x0000000003396000-memory.dmp
memory/2568-22-0x0000000001430000-0x0000000001488000-memory.dmp
memory/2568-44-0x00000000015C0000-0x000000000176C000-memory.dmp
memory/2568-42-0x0000000003350000-0x0000000003396000-memory.dmp
memory/3184-33-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/3184-34-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/3184-32-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/3184-35-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/3184-39-0x00000000030A0000-0x00000000030E6000-memory.dmp
memory/3184-41-0x00000000030A0000-0x00000000030E6000-memory.dmp
memory/3184-38-0x00000000030A0000-0x00000000030E6000-memory.dmp
memory/3184-43-0x00000000030A0000-0x00000000030E6000-memory.dmp
memory/3184-45-0x00000000011A0000-0x000000000134C000-memory.dmp
memory/3184-37-0x0000000002EC0000-0x0000000002F18000-memory.dmp