valleyrat_s2 | 0f2e83485f3bb7c4837ecbadb53556a0b51feff2f19522ed09bebac09a13b0a2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar.exe
Size 21.6MB
Sample260527-eellbsey7k
SHA256 0f2e83485f3bb7c4837ecbadb53556a0b51feff2f19522ed09bebac09a13b0a2
MD5 b803210c3d1a1adb75a7e8562e60b2fe
SHA1 e4edcccd2459d1a524129151b1ba04de3da25540
SHA512 7a99ce262b7de51d95723a7cb226a08232f7815561a0068d34fc37e997915d25b6f00b558d08c693277402a68b00a239e72929b6724aa476267b60bbaa44fb08
SSDEEP 393216:eIZKZ9ZvoRFCgd3Ns9AQyv2BE5fF5Hnb3VEQJPUQvs48sXPH++qePUQj18n:Po9ZvQCgd3OA9eB6Vb3/sQkSXPe+lPUD
TLSH
T1F737331673F820EAF5B29779897A694AA7717C720B11D2DF12606D9D3F727C08E30722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion valleyrat_s2 persistence privilege_escalation

Malware Config

Extracted

Family

valleyrat_s2

Version

27.124.45.97:3390
27.124.45.118:3391
127.0.0.1:80

Attributes

campaign_date
2026. 5.14

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
5432	edgesvc.exe
2088	edgesvc.exe

Loads dropped DLL 4 IoCs

pid	Process
5432	edgesvc.exe
5432	edgesvc.exe
2088	edgesvc.exe
2088	edgesvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge-v1\\sec_920C\\edgesvc.exe"	edgesvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1204	timeout.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Accessibility\Blind Access\On = "1"	edgesvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Control Panel\Accessibility\Blind Access\On = "1"	edgesvc.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ThreadingModel = "Apartment"	edgesvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32	edgesvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID	edgesvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}	edgesvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\EdgeUpdate\\msedgeupdate.db"	edgesvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5432	edgesvc.exe
5432	edgesvc.exe
2088	edgesvc.exe
2088	edgesvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2136	1476	2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar.exe	81
PID 2136 wrote to memory of 1204	2136	cmd.exe	83
PID 2136 wrote to memory of 5432	2136	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 3 /nobreak >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar.exe" & "C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\edgesvc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1204
- - C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\edgesvc.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\edgesvc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5432

C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\edgesvc.exe
C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\edgesvc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EVENT.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\EVENT.dll
Size 113KB
SHA256 ba025147207669133548570b3ef054771c74d1ff70cb2366a2a7a17e3b705403
MD5 4a1359f776f6f4533ea69945be76a97d
SHA1 59b017eb8a20e4ef29e52e18fe1d3f69636105cc
SHA512 14ecdeceff2b427d4bfc13d0fba33416e6612667786bdc1f04b1f693789e1e481c61fef8e86fe8d3dc995fae668eaefb396ca78b29fb5a2697550733a0b8f465
SSDEEP 3072:5QD79+OkxnBBxEWI90CBneajKJp7P2RYzZE:y9rkvHfI90KneFtXK
TLSH
T17EB35C5B77E100BBE5B78678C8A30A06D376BC551760AFEF03A0465A1F673E18D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EVENT_original.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\EVENT_original.dll
Size 43KB
SHA256 2e508792c5030c8f7966591f56f51d34e8f03d7aeb3e3bdeb0402d01033a9457
MD5 559a8b80c53774df5929151052b5cf27
SHA1 9897a000b98cef7ebe799606431c3c491d2bcd83
SHA512 6f953db662b96bd7bf77c5c1aa3dedef8b00be14a5472b670f5d2dc5da6ce8bfe8e94c91b3556d64c3aa66c60c607419bb0758856ad51d3b7a30effa2095bce9
SSDEEP 768:q6JZ+kY/NXXYstakiDn59SU3YVG+UeFvox+1jbM8Ox9z1Ena:hyhKLjSU3YVG+UeFv8EwDz1Ea
TLSH
T1BC13194173E89048F462AA748F67DB4AE934F9985B12C2DF2261934F0F727D48E347B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edgesvc.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\edgesvc.exe
Size 178KB
SHA256 406f378e14538b78bb01a5298ff4770de0be95a71c1b7f814dfc19c3bc36c012
MD5 9aab60fdb3e37c1e8477af8ebcaacf71
SHA1 97e9219545c79c6203b8f6c8ff18cb5c7d8b8694
SHA512 47fa9cdb800846fe622c97f10058a831b05b206b42c74013e2c543fa3e147611334c898ad854762478e3fa9951d79e5fbb301773a1d791d5a6437a53e6244ed9
SSDEEP 3072:MLfVkJJ8M0Hq91TuVagOhnddgxIXhijscGP4PqgF3UMKYMKhCf/Ch5xAsrqt8p+q:mfVscqtgChijscGP4PqgF3UMKYMKhY3c
TLSH
T193046E5633FD20D5F5BA9B386AB68922E776BC761B15D6CF119004AE0E32BC49D34332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdate.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge-v1\sec_920C\msedgeupdate.dat
Size 177KB
SHA256 4094b91db4401f3938a3ed2157807d47cc563d46dd695a000d638b54c0da0909
MD5 49dd90f671b59eda007deb084f026e92
SHA1 de802b54e28e5e122a0f35687ded9e4c7aa6ae70
SHA512 d8ad5c7aae0545614818667ce205761287cfd03927cb04dc34a2902901f98366ffbf5cf37cd2461966553ff8e427f7193730c471edb58ccb3da6775d57b9523d
SSDEEP 3072:7uzUTLivMlq6s67QsuuebinuGCkFucPUHiOGc7OrbewIXHwI31hAz5FoZFp8:SzUTGEyIuFkFzPUHZEryZwI3LWFou
TLSH
T13A043967F04911E761D1FC2D597B91F3A98A322B217790E30E222D3201AC4DBB9E5DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-29-0x0000000180000000-0x0000000180034000-memory.dmp

Download

memory/2088-32-0x0000000180000000-0x0000000180034000-memory.dmp

Download

memory/5432-13-0x0000000180000000-0x0000000180034000-memory.dmp

Download

memory/5432-19-0x0000000180000000-0x0000000180034000-memory.dmp

Download

memory/5432-30-0x0000000180000000-0x0000000180034000-memory.dmp

Download