Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/04/2026, 11:41
Behavioral task
behavioral1
Sample
2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe
- Size 130KB
- Sample260429-ntldjsa16t
- SHA256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05
- MD5 5f93c2f5ecb40c200199a55ff7f53df1
- SHA1 7f4ac9c2aef0c8bd1c011443cd2685e7dcc026fc
- SHA512 06af4d233a2efc0009fda579e0f4af92c0b0ecbbd674d58a22710af872b5a2865c1468023daac85535d0a34d6489c25bc690f096ad0e545db3d7881b22687e86
- SSDEEP 3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6ow:lO5n5d56TYZQnB+Dpekyyqm
- TLSH T1A2D37D4733A450F9D4A78279C9A25A06E7B374660735A7CF17A086BA2F137D0BD3A331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 7 IoCs
resource yara_rule behavioral1/memory/3256-2-0x0000000003600000-0x000000000364E000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-1-0x0000000003600000-0x000000000364E000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-0-0x0000000003140000-0x0000000003187000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-3-0x0000000003600000-0x000000000364E000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-4-0x0000000003600000-0x000000000364E000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-5-0x0000000003600000-0x000000000364E000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-7-0x0000000003600000-0x000000000364E000-memory.dmp family_valleyrat_stage_2_v2 - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\Y: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\R: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\B: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\J: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\Q: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\S: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\E: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\K: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\L: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\M: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\U: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\V: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\W: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\X: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\G: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\H: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\I: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\N: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\O: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\Z: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe File opened (read-only) \??\P: 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3256 2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe"C:\Users\Admin\AppData\Local\Temp\2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3256