Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
13/04/2026, 08:00
General
- Target 2026_04_13_Комплект_разъемов_ЭБУ_19_06_13_Вектор_doc.vbs
- Size 6.8MB
- Sample260413-jv4jasas5t
- SHA256 e20777394d4754a326ecb9307d24176687e1c6a002d6afa5c8c330cfe3c792e9
Malware Config
Extracted
-
valleyrat_s2
-
2026. 1. 5
-
xiyuenet.com:5050
-
campaign_date
2026. 1. 5
Signatures
- ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Valleyrat_s2 family
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Possible privilege escalation attempt 4 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 5 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2026_04_13_Комплект_разъемов_ЭБУ_19_06_13_Вектор_doc.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nDDcuLdilifwm3C2Qfc81EsCY58Ev-g0GvXrXoopYnAnvBrtg53xDiDJjcOqSYdCbYG0IXV2.exe"C:\Users\Admin\AppData\Local\Temp\nDDcuLdilifwm3C2Qfc81EsCY58Ev-g0GvXrXoopYnAnvBrtg53xDiDJjcOqSYdCbYG0IXV2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TMKXGQAQDK.tmp\nDDcuLdilifwm3C2Qfc81EsCY58Ev-g0GvXrXoopYnAnvBrtg53xDiDJjcOqSYdCbYG0IXV2.tmp"C:\Users\Admin\AppData\Local\Temp\is-TMKXGQAQDK.tmp\nDDcuLdilifwm3C2Qfc81EsCY58Ev-g0GvXrXoopYnAnvBrtg53xDiDJjcOqSYdCbYG0IXV2.tmp" /SL5="$6023E,4137616,887296,C:\Users\Admin\AppData\Local\Temp\nDDcuLdilifwm3C2Qfc81EsCY58Ev-g0GvXrXoopYnAnvBrtg53xDiDJjcOqSYdCbYG0IXV2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -Command "Expand-Archive -Path 'C:\Users\Public\Documents\bmrjTOYYbMIJsBS.zip' -DestinationPath 'C:\Users\Public\Documents' -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\Documents\XBazJkKaYJZmkVB.xml"C:\Users\Public\Documents\XBazJkKaYJZmkVB.xml" x "C:\Users\Public\Documents\VGHyOkUQKnOBFio" -p"vArvMiWxsnJQflb" -o"C:\Users\Public\Documents" -y4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\Documents\RunCode.exe"C:\Users\Public\Documents\RunCode.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exeC:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\x86-Microsoft-Windowsdata\WUDFCompanionHoste.exeC:\Users\Public\Documents\x86-Microsoft-Windowsdata\WUDFCompanionHoste.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c netsh advfirewall show allprofiles state6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall show allprofiles state7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a >nul 2>&1 & icacls "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F >nul 2>&1 & takeown /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F >nul 2>&1 & icacls "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /deny Everyone:D >nul 2>&1 & powershell -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData'; $acl = (Get-Item -Path $regPath).GetAccessControl(); $acl.SetAccessRuleProtection($true); $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_); }; $sidSystem = New-Object System.Security.Principal.Security.Identity('S-1-5-18'); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidSystem,'FullControl','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidAdmins,'ReadKey','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidEveryone,'Delete','Deny'))); (Get-Item -Path $regPath).SetAccessControl($acl); Disable-ScheduledTask -TaskName 'WindowsPowerShell.WbemScripting.WindowsData'; Write-Host 'X' -ForegroundColor Green;\""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /deny Everyone:D6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData'; $acl = (Get-Item -Path $regPath).GetAccessControl(); $acl.SetAccessRuleProtection($true); $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_); }; $sidSystem = New-Object System.Security.Principal.Security.Identity('S-1-5-18'); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidSystem,'FullControl','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidAdmins,'ReadKey','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidEveryone,'Delete','Deny'))); (Get-Item -Path $regPath).SetAccessControl($acl); Disable-ScheduledTask -TaskName 'WindowsPowerShell.WbemScripting.WindowsData'; Write-Host 'X' -ForegroundColor Green;\"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "ping -n 1 127.0.0.1 >nul & del /f /q ""C:\Users\Public\Documents\RunCode.exe"" & del /f /q ""%0"""5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exeC:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zorrkycm.ojj.ps1
nDDcuLdilifwm3C2Qfc81EsCY58Ev-g0GvXrXoopYnAnvBrtg53xDiDJjcOqSYdCbYG0IXV2.tmp
nDDcuLdilifwm3C2Qfc81EsCY58Ev-g0GvXrXoopYnAnvBrtg53xDiDJjcOqSYdCbYG0IXV2.exe
RunCode.exe
RunServer.dat
VGHyOkUQKnOBFio
XBazJkKaYJZmkVB.xml
bmrjTOYYbMIJsBS.zip
StartMenuExperienceHostker.exe
WUDFCompanionHoste.exe
log.dll
smss.exe
memory/944-87-0x00000000009D0000-0x0000000000AB8000-memory.dmp
memory/944-10-0x00000000009D0000-0x0000000000AB8000-memory.dmp
memory/1052-18-0x00000000018A0000-0x00000000018A1000-memory.dmp
memory/1052-76-0x0000000005A70000-0x0000000005EAB000-memory.dmp
memory/1052-75-0x0000000000950000-0x0000000000D9A000-memory.dmp
memory/1676-109-0x000001E264370000-0x000001E26440E000-memory.dmp
memory/1676-119-0x000001E264370000-0x000001E26440E000-memory.dmp
memory/2320-53-0x0000000008090000-0x000000000809A000-memory.dmp
memory/2320-24-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/2320-48-0x0000000007F20000-0x0000000007FB6000-memory.dmp
memory/2320-49-0x0000000007EA0000-0x0000000007EB1000-memory.dmp
memory/2320-50-0x0000000007FF0000-0x0000000008012000-memory.dmp
memory/2320-51-0x0000000008F00000-0x00000000094A6000-memory.dmp
memory/2320-52-0x00000000080A0000-0x00000000080B2000-memory.dmp
memory/2320-45-0x00000000082D0000-0x000000000894A000-memory.dmp
memory/2320-46-0x0000000007C90000-0x0000000007CAA000-memory.dmp
memory/2320-61-0x0000000005850000-0x0000000005856000-memory.dmp
memory/2320-62-0x0000000005900000-0x0000000005915000-memory.dmp
memory/2320-44-0x0000000007950000-0x00000000079F4000-memory.dmp
memory/2320-43-0x0000000006F40000-0x0000000006F5E000-memory.dmp
memory/2320-36-0x000000006FFC0000-0x000000007000C000-memory.dmp
memory/2320-35-0x0000000007910000-0x0000000007944000-memory.dmp
memory/2320-34-0x0000000006E00000-0x0000000006E4C000-memory.dmp
memory/2320-33-0x0000000006930000-0x000000000694E000-memory.dmp
memory/2320-32-0x0000000006480000-0x00000000067D7000-memory.dmp
memory/2320-25-0x0000000006410000-0x0000000006476000-memory.dmp
memory/2320-47-0x0000000007D10000-0x0000000007D1A000-memory.dmp
memory/2320-23-0x0000000005A80000-0x0000000005AA2000-memory.dmp
memory/2320-22-0x0000000005C70000-0x000000000629A000-memory.dmp
memory/2320-21-0x0000000003470000-0x00000000034A6000-memory.dmp
memory/2992-13-0x000001C18F040000-0x000001C18F0DE000-memory.dmp
memory/2992-14-0x000001C18F160000-0x000001C18F16C000-memory.dmp
memory/3880-132-0x000001ECCF390000-0x000001ECCF3A2000-memory.dmp
memory/3880-120-0x000001ECE7690000-0x000001ECE76B2000-memory.dmp
memory/3880-130-0x000001ECCD5C0000-0x000001ECCD65E000-memory.dmp
memory/3880-131-0x000001ECCEF20000-0x000001ECCEF2C000-memory.dmp
memory/4368-104-0x0000000002F70000-0x0000000002FB6000-memory.dmp
memory/4368-105-0x0000000002F70000-0x0000000002FB6000-memory.dmp
memory/4368-110-0x00000000027B0000-0x000000000286B000-memory.dmp
memory/4368-106-0x0000000002F70000-0x0000000002FB6000-memory.dmp
memory/4368-111-0x0000000000B50000-0x0000000000B56000-memory.dmp
memory/4368-95-0x0000000010000000-0x0000000010025000-memory.dmp
memory/4368-103-0x0000000002F70000-0x0000000002FB6000-memory.dmp
memory/4368-138-0x00000000027B0000-0x000000000286B000-memory.dmp
memory/4368-144-0x00000000027B0000-0x000000000286B000-memory.dmp
memory/4368-158-0x00000000027B0000-0x000000000286B000-memory.dmp