Analysis
- max time kernel
150s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/03/2026, 12:29
Behavioral task
behavioral1
Sample
2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
- Size 108KB
- Sample260311-pn1fysfs4v
- SHA256 b6cdf2eeb51528ad72b5180102f35039f95ffc01bba133ddc6fac17bbb89621c
- MD5 c2fadc44f35501190f017a9f095bfa75
- SHA1 21423bbddba659a6a8402db68fa16f1c7d7c5758
- SHA512 d934bfeb1b602e72c55d99c8130988973d894a48435cebcac3d086ffef350af383c411c81b27bfeaa23d69e6886050b9ab90c36a46684e3e421c632b770f3242
- SSDEEP 3072:TXFiAVA5v6if7FMwrrInnjpE6Ux68XEPKb:rFih5v1mwrr0Xt1y
- TLSH T160B37B2172E0C072D097253159F9EBB24A7EF93113B844CBB7E816BA5F603C16A7539B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects ValleyRAT payload 11 IoCs
resource yara_rule behavioral2/memory/3804-0-0x0000000000950000-0x0000000000991000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-1-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-2-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-4-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-3-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-9-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-8-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-10-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-12-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-11-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3804-15-0x0000000000FB0000-0x0000000000FF8000-memory.dmp family_valleyrat_stage_2_v2 - ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: tracerpt.exe File opened (read-only) \??\Z: tracerpt.exe File opened (read-only) \??\S: tracerpt.exe File opened (read-only) \??\V: tracerpt.exe File opened (read-only) \??\G: tracerpt.exe File opened (read-only) \??\J: tracerpt.exe File opened (read-only) \??\K: tracerpt.exe File opened (read-only) \??\L: tracerpt.exe File opened (read-only) \??\M: tracerpt.exe File opened (read-only) \??\N: tracerpt.exe File opened (read-only) \??\P: tracerpt.exe File opened (read-only) \??\Y: tracerpt.exe File opened (read-only) \??\B: tracerpt.exe File opened (read-only) \??\E: tracerpt.exe File opened (read-only) \??\I: tracerpt.exe File opened (read-only) \??\O: tracerpt.exe File opened (read-only) \??\Q: tracerpt.exe File opened (read-only) \??\U: tracerpt.exe File opened (read-only) \??\W: tracerpt.exe File opened (read-only) \??\X: tracerpt.exe File opened (read-only) \??\H: tracerpt.exe File opened (read-only) \??\R: tracerpt.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2340 set thread context of 3804 2340 2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 77 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tracerpt.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe 3804 tracerpt.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3804 tracerpt.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3804 tracerpt.exe Token: SeDebugPrivilege 3804 tracerpt.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3804 tracerpt.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2340 wrote to memory of 3804 2340 2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 77 PID 2340 wrote to memory of 3804 2340 2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 77 PID 3804 wrote to memory of 4872 3804 tracerpt.exe 79 PID 3804 wrote to memory of 4872 3804 tracerpt.exe 79 PID 3804 wrote to memory of 4872 3804 tracerpt.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-11_c2fadc44f35501190f017a9f095bfa75_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\tracerpt.exe"C:\Windows\SysWOW64\tracerpt.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵PID:4872
-
-