Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7528ce802f369983585b23397257075c67f2079a6475d59ba07218129a59a00.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7528ce802f369983585b23397257075c67f2079a6475d59ba07218129a59a00.dll
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target b7528ce802f369983585b23397257075c67f2079a6475d59ba07218129a59a00.dll
- Size 109KB
- Sample260528-pllvsaft7p
- SHA256 b7528ce802f369983585b23397257075c67f2079a6475d59ba07218129a59a00
- MD5 82ff9cd723827e9061d5db47f5e658af
- SHA1 a04eed483646aa4d7cd6cb83ce1dfd95935c6813
- SHA512 88b5e035747cea0d2ce24ec6953b217ae06c565c133884ce70b4919b001c96263da05b70e06204d5718b786039793df424b8470f093775cdeb68079a7079afd7
- SSDEEP 3072:l3hrnnbUkUVqojgL2oThYJ/mAmYNwuXhp5Sgfexswhci1AlO0cu:XUkecPlq/vmYSWVeF+hc
- TLSH T1BCB34BD0BC91D033D26A0C344824DE658F6EBC915FA1BCDB77940EFA4D30AD1AB35A26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.76.156.68:2585
Attributes
-
campaign_date
2026. 4.14
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 26 IoCs
resource yara_rule behavioral1/memory/4452-7-0x0000000002330000-0x000000000236F000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-9-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-14-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-15-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-17-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-16-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-24-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-27-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-28-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-29-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-30-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-42-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-44-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-43-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-45-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-69-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-74-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4452-73-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-75-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-87-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-88-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-89-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-90-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-115-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-117-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/432-116-0x0000000010000000-0x0000000010046000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 10 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 432 rundll32.exe 9 432 rundll32.exe 11 432 rundll32.exe 30 432 rundll32.exe 39 432 rundll32.exe 45 432 rundll32.exe 50 432 rundll32.exe 51 432 rundll32.exe 53 432 rundll32.exe 61 432 rundll32.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: ThumbnailExtractionHost.exe File opened (read-only) \??\V: ThumbnailExtractionHost.exe File opened (read-only) \??\H: ThumbnailExtractionHost.exe File opened (read-only) \??\K: ThumbnailExtractionHost.exe File opened (read-only) \??\N: ThumbnailExtractionHost.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\E: ThumbnailExtractionHost.exe File opened (read-only) \??\J: ThumbnailExtractionHost.exe File opened (read-only) \??\P: ThumbnailExtractionHost.exe File opened (read-only) \??\R: ThumbnailExtractionHost.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\G: ThumbnailExtractionHost.exe File opened (read-only) \??\M: ThumbnailExtractionHost.exe File opened (read-only) \??\Y: ThumbnailExtractionHost.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\S: ThumbnailExtractionHost.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\X: ThumbnailExtractionHost.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\B: ThumbnailExtractionHost.exe File opened (read-only) \??\Q: ThumbnailExtractionHost.exe File opened (read-only) \??\U: ThumbnailExtractionHost.exe File opened (read-only) \??\W: ThumbnailExtractionHost.exe File opened (read-only) \??\Z: ThumbnailExtractionHost.exe File opened (read-only) \??\O: ThumbnailExtractionHost.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\I: ThumbnailExtractionHost.exe File opened (read-only) \??\L: ThumbnailExtractionHost.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2828 tasklist.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ThumbnailExtractionHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ThumbnailExtractionHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3604 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe 4452 ThumbnailExtractionHost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2828 tasklist.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4452 ThumbnailExtractionHost.exe 432 rundll32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4108 wrote to memory of 432 4108 rundll32.exe 85 PID 432 wrote to memory of 4452 432 rundll32.exe 108 PID 432 wrote to memory of 4452 432 rundll32.exe 108 PID 4452 wrote to memory of 1744 4452 ThumbnailExtractionHost.exe 111 PID 1744 wrote to memory of 2828 1744 cmd.exe 113 PID 1744 wrote to memory of 372 1744 cmd.exe 114 PID 1744 wrote to memory of 1548 1744 cmd.exe 115 PID 1744 wrote to memory of 3604 1744 cmd.exe 116
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b7528ce802f369983585b23397257075c67f2079a6475d59ba07218129a59a00.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b7528ce802f369983585b23397257075c67f2079a6475d59ba07218129a59a00.dll,#12⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"C:\Windows\system32\ThumbnailExtractionHost.exe"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\\svchost_tmp.bat"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq ThumbnailExtractionHost.exe"5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\SysWOW64\find.exefind /I "ThumbnailExtractionHost.exe"5⤵
- System Location Discovery: System Language Discovery
PID:372
-
-
C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1548
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3604
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\svchost_tmp.bat
- Size 567B
- SHA256 8a9206907b2ce054fdb88b2fcf072625193d1ccab852a92e4d755829c95cecac
- MD5 f40e09dd6aa9cfba7cf6f983ae25e080
- SHA1 67b95b0616f63ee077df09cd90f069b1f41a137f
- SHA512 c6ba6fd023dd3a27fe42ee5679c74520d07741992ce45856192eacce5aa0f1c56ef0f6110a232f872d333c5fd6ddadae118db1bf83e74bc328fbd6ecfb980943
- TLSH T184F08B45A2C8514544FC1023BA7D6D8FD36EC85623C8F3D87000CCAD708E00BF68D384
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\svchost_tmp.bat
- Size 597B
- SHA256 6092a153ea3e2acf5274408c3a0e6e645af7eeebe92d905181ecd0105484e9fd
- MD5 26fe974f752f96b2a6990b58967c9a29
- SHA1 23d3bc0e13509eaed983f5cc4fc05154709686fb
- SHA512 4ac01a8cc269d87caba9730810abd4be4870567183a6a16ab2c7633fe0aa2cbc0c48caad4c863974d28384c8ee84e37d4106a3e22dbfbc112c31c06238ddea6e
- TLSH T1F5F04645A2C9954544FD1027EABD6D8BE36EC84617C8F3CD7610C8AE658E04BFACE394
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~$temp.tmp
- Size 4B
- SHA256 0c75ccaac2812081198391f595e46d12ec1d3cbb0f5aa664e6631f110ae4526c
- MD5 418ef6127e44214882c61e372e866691
- SHA1 16b5eb5172fe24f3ec4dafdd4593f04f50c205cc
- SHA512 7e946b2b431f21195347497d5b6f3d3a49784414d5a457f6f2b3d7bffc29fc4c50062cc8d1a4f8c1b2937e715634ae191d6b4fe88bd85d2a186c870054565274
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\~cache.tmp
- Size 60KB
- SHA256 0693f6bfa2117a9b14f9ceca13d3a5611de5dca226bf999f20a7f615fbd08dff
- MD5 84c48b8da7e9b9d3c5667ad9819debd9
- SHA1 d2258cfecefde0e3ad67dd5b9883a2bbc60890e8
- SHA512 dadd824e3dfa31df873a418d0d4fafeee5ce1e2267e359c68c17e5a0aac193afa07d1f2c0c74d1d8670a161463694225200fd8e7fbe56d4ba87c7b4c6047d9b3
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP