Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
12/04/2026, 13:30
General
- Target d5972e6e2ac85792c7fe48ac182b19fbc113595f5d34f6cb87ec1360ff11b010.exe
- Size 5.6MB
- Sample260412-qrtcgscv7j
- SHA256 d5972e6e2ac85792c7fe48ac182b19fbc113595f5d34f6cb87ec1360ff11b010
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
27.124.34.8:10801
-
127.0.0.1:10801
-
campaign_date
2026. 4.11
Signatures
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5972e6e2ac85792c7fe48ac182b19fbc113595f5d34f6cb87ec1360ff11b010.exe"C:\Users\Admin\AppData\Local\Temp\d5972e6e2ac85792c7fe48ac182b19fbc113595f5d34f6cb87ec1360ff11b010.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AppRuntime\animation_desktop_webgl.exeC:\Users\Admin\AppData\Local\AppRuntime\animation_desktop_webgl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cd /d "C:\Users\Admin\AppData\Local\Temp\Temmp" && start "" "animation_desktop_webgl.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Temmp\animation_desktop_webgl.exe"animation_desktop_webgl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\Users\Admin\AppData\Local\Temp\Temmp\" && start /B "" "C:\Users\Admin\AppData\Local\Temp\Temmp\animation_desktop_webgl.exe" && exit"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Temmp\animation_desktop_webgl.exe"C:\Users\Admin\AppData\Local\Temp\Temmp\animation_desktop_webgl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
animation_desktop_webgl.exe
config.ini
libcef.dll
memory/1124-53-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-52-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-78-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-76-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-71-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-66-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-65-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-51-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-35-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-34-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-33-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-32-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-31-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-30-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-54-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-55-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-39-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-41-0x0000000002300000-0x000000000232C000-memory.dmp
memory/1124-56-0x0000000002F30000-0x0000000002F72000-memory.dmp
memory/1124-50-0x0000000002300000-0x000000000232C000-memory.dmp
memory/4108-72-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-44-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-48-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-46-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-45-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-42-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-47-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-43-0x0000000003340000-0x000000000337C000-memory.dmp
memory/4108-36-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-38-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-23-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-19-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/4108-25-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-49-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-60-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-62-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-59-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-27-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-69-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-28-0x00000000029C0000-0x0000000002A41000-memory.dmp
memory/4108-24-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-29-0x0000000002970000-0x000000000299C000-memory.dmp
memory/4108-77-0x00000000034C0000-0x0000000003502000-memory.dmp
memory/4108-26-0x0000000002970000-0x000000000299C000-memory.dmp