Analysis
- max time kernel
149s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
13/03/2026, 04:29
General
- Target 2026-03-13_558fcfa68b38c907313eefa4edc84908_elex_remcos_stop.exe
- Size 3.2MB
- Sample260313-e4l86ahs9z
- SHA256 e0278beeea0d2cf18d33b07a4807afe78dbd3f66769f02578009d1e0c281c999
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
156.247.41.101:6699
-
127.0.0.1:80
-
campaign_date
2026. 3. 5
Signatures
- Detects ValleyRAT payload 19 IoCs
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 11 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-13_558fcfa68b38c907313eefa4edc84908_elex_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-13_558fcfa68b38c907313eefa4edc84908_elex_remcos_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Videos\ChsIMA.exeC:\Users\Public\Videos\ChsIMA.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Public\Videos\ChsIMA.exeC:\Users\Public\Videos\ChsIMA.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
20260313042947247~YingInstall-TopFramePicture.bmp
CCTV 1.0.UIF
ChsIMA.exe
active_desktop_render.dll
cports.exe
msedge.exe
msedge_proxy.exe
memory/3884-96-0x00000000023A0000-0x000000000247A000-memory.dmp
memory/3884-55-0x00000000023A0000-0x000000000247A000-memory.dmp
memory/4076-94-0x00000000041A0000-0x00000000041C9000-memory.dmp
memory/4076-80-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-84-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-89-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-83-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-82-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-81-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-79-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-92-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4076-90-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-91-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4076-78-0x0000000002F90000-0x0000000002FCC000-memory.dmp
memory/4076-73-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4076-98-0x0000000004D10000-0x0000000004DEA000-memory.dmp
memory/4076-77-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4076-75-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4076-76-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4076-72-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/5768-51-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-70-0x0000000000F70000-0x0000000000F97000-memory.dmp
memory/5768-71-0x0000000000F70000-0x0000000000F97000-memory.dmp
memory/5768-74-0x0000000004190000-0x00000000041B9000-memory.dmp
memory/5768-67-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-66-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-57-0x0000000010000000-0x0000000010035000-memory.dmp
memory/5768-65-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-56-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-54-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-53-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-52-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-50-0x0000000003080000-0x00000000030BC000-memory.dmp
memory/5768-48-0x0000000000F70000-0x0000000000F97000-memory.dmp
memory/5768-49-0x0000000002F00000-0x0000000002F37000-memory.dmp
memory/5768-47-0x0000000000F70000-0x0000000000F97000-memory.dmp
memory/5768-46-0x0000000000F70000-0x0000000000F97000-memory.dmp
memory/5768-45-0x0000000000F70000-0x0000000000F97000-memory.dmp
memory/5768-44-0x0000000000F70000-0x0000000000F97000-memory.dmp
memory/5768-43-0x0000000000EE0000-0x0000000000F61000-memory.dmp
memory/5768-42-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
memory/5768-100-0x0000000004DB0000-0x0000000004E8A000-memory.dmp