Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 12:14
General
- Target 2026-05-23_cf0330cf288105770595c97ddda66159_cobalt-strike_icedid.exe
- Size 250KB
- Sample260523-pec93acs8s
- SHA256 b90f03dc2e269ce96bffc068a658c041493046c3c72732aa3ba0c004643df2e2
Score
10/10
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
127.0.0.1:6666
-
127.0.0.1:8888
-
127.0.0.1:80
Attributes
-
campaign_date
2026. 5.20
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects DonutLoader 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_cf0330cf288105770595c97ddda66159_cobalt-strike_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_cf0330cf288105770595c97ddda66159_cobalt-strike_icedid.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4320-0-0x000002B97D190000-0x000002B97D1B6000-memory.dmp
memory/4320-1-0x000002B97D3D0000-0x000002B97D3F9000-memory.dmp