Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 07:36
General
- Target 69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe
- Size 151KB
- Sample260422-jfe76aew3x
- SHA256 69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
192.238.184.143:10801
-
127.0.0.1:10801
-
campaign_date
2026. 4.22
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe"C:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exeC:\Users\Admin\AppData\Local\Temp\69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3.exe1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1536-17-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-0-0x00000000013E0000-0x00000000013E1000-memory.dmp
memory/1536-7-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-6-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-5-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-3-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-4-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-2-0x00000000032C0000-0x0000000003341000-memory.dmp
memory/1536-11-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-9-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-13-0x0000000003AC0000-0x0000000003AFC000-memory.dmp
memory/1536-18-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-8-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-34-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-24-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-19-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-14-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-12-0x0000000003230000-0x000000000325C000-memory.dmp
memory/1536-15-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-25-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-61-0x0000000004C30000-0x0000000004D0A000-memory.dmp
memory/1536-57-0x0000000004C30000-0x0000000004D0A000-memory.dmp
memory/1536-16-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-54-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-46-0x0000000003C40000-0x0000000003C82000-memory.dmp
memory/1536-35-0x0000000003230000-0x000000000325C000-memory.dmp
memory/2960-29-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-32-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-36-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-38-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-39-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-41-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-44-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-45-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-43-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-42-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-40-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-27-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-51-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-52-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-28-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-56-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-30-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-58-0x00000000036D0000-0x0000000003712000-memory.dmp
memory/2960-31-0x0000000002D60000-0x0000000002D8C000-memory.dmp
memory/2960-64-0x0000000005240000-0x000000000531A000-memory.dmp