Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 07:36
General
- Target 69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe
- Size 151KB
- Sample260422-jfe76aew3x
- SHA256 69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
192.238.184.143:10801
-
127.0.0.1:10801
-
campaign_date
2026. 4.22
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe"C:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exeC:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/2308-45-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-33-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-59-0x00000000030A0000-0x0000000003136000-memory.dmp
memory/2308-58-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-56-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-53-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-52-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-49-0x00000000030A0000-0x0000000003136000-memory.dmp
memory/2308-42-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-43-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-44-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-46-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-34-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-31-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-47-0x0000000003050000-0x0000000003092000-memory.dmp
memory/2308-32-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-41-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-40-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-38-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-30-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/2308-29-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/4988-14-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-13-0x0000000003660000-0x000000000369C000-memory.dmp
memory/4988-17-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-19-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-27-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-36-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-37-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-24-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-15-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-16-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-18-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-2-0x0000000002CB0000-0x0000000002D31000-memory.dmp
memory/4988-0-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/4988-12-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-11-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-9-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-48-0x00000000037E0000-0x0000000003822000-memory.dmp
memory/4988-5-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-4-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-3-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-7-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-57-0x0000000003830000-0x00000000038C6000-memory.dmp
memory/4988-8-0x0000000002E70000-0x0000000002E9C000-memory.dmp
memory/4988-6-0x0000000002E70000-0x0000000002E9C000-memory.dmp