Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/05/2026, 06:20
General
- Target wang-yi-yun-003.exe
- Size 4.9MB
- Sample260525-g32cssbw4n
- SHA256 62bb24f5f1c68116d03a51d10686a3e08859241b49d8283dadb44034ae0c1108
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
27.124.45.97:3390
-
27.124.45.118:3391
-
127.0.0.1:80
-
campaign_date
2026. 5.14
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects DonutLoader 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wang-yi-yun-003.exe"C:\Users\Admin\AppData\Local\Temp\wang-yi-yun-003.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\windows\system32\svchost.exeC:\windows\system32\svchost.exe2⤵
- Drops file in Drivers directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DisplaySessionContainers.log
DisplaySessionContainers.log
DisplaySessionContainers.log
memory/456-78-0x000001D292E90000-0x000001D292EF5000-memory.dmp
memory/456-79-0x000001D294B30000-0x000001D294BDF000-memory.dmp
memory/4488-25-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-30-0x0000000180000000-0x0000000180021000-memory.dmp
memory/4488-12-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-11-0x000001BE76460000-0x000001BE76494000-memory.dmp
memory/4488-10-0x000001BE76460000-0x000001BE76494000-memory.dmp
memory/4488-9-0x000001BE76680000-0x000001BE766D2000-memory.dmp
memory/4488-18-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-17-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-21-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-23-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-22-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-3-0x000001BE76460000-0x000001BE76494000-memory.dmp
memory/4488-26-0x00007FFDE7CF0000-0x00007FFDE7EE5000-memory.dmp
memory/4488-27-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-28-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-13-0x000001BE76680000-0x000001BE766D2000-memory.dmp
memory/4488-29-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-35-0x00007FFDE7CF0000-0x00007FFDE7EE5000-memory.dmp
memory/4488-40-0x000001BE76A60000-0x000001BE76A8D000-memory.dmp
memory/4488-37-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-51-0x000001BE76CE0000-0x000001BE76D07000-memory.dmp
memory/4488-50-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-63-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-62-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-14-0x000001BE766E0000-0x000001BE7673A000-memory.dmp
memory/4488-8-0x000001BE76460000-0x000001BE76494000-memory.dmp
memory/4488-7-0x000001BE76460000-0x000001BE76494000-memory.dmp
memory/4488-5-0x000001BE76460000-0x000001BE76494000-memory.dmp
memory/4488-4-0x000001BE76460000-0x000001BE76494000-memory.dmp