Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
02/07/2026, 02:23
General
- Target 商城7800万美金聊天记录g.exe
- Size 2.3MB
- Sample260702-cvasnabs6s
- SHA256 a372c6797c7dd896a09b02333de191a2f3eca4ac3ae3786f3f45f67dc27445b6
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
134.122.129.88:6666
-
134.122.129.88:8888
-
127.0.0.1:80
-
campaign_date
2026. 6. 5
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\商城7800万美金聊天记录g.exe"C:\Users\Admin\AppData\Local\Temp\商城7800万美金聊天记录g.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
IOCPTcp.dll
boot.log
rtyrtfd20260702.log
rtyrtfd.exe
memory/2300-30-0x0000000003D80000-0x0000000003DD8000-memory.dmp
memory/2300-33-0x0000000003D80000-0x0000000003DD8000-memory.dmp
memory/2300-21-0x00000000031E0000-0x00000000031FC000-memory.dmp
memory/2300-23-0x00000000031E0000-0x00000000031FC000-memory.dmp
memory/2300-22-0x00000000038A0000-0x0000000003921000-memory.dmp
memory/2300-24-0x00000000031E0000-0x00000000031FC000-memory.dmp
memory/2300-25-0x00000000031E0000-0x00000000031FC000-memory.dmp
memory/2300-28-0x0000000001180000-0x0000000001280000-memory.dmp
memory/2300-27-0x00000000031E0000-0x00000000031FC000-memory.dmp
memory/2300-29-0x0000000003D80000-0x0000000003DD8000-memory.dmp
memory/2300-19-0x0000000001770000-0x0000000001772000-memory.dmp
memory/2300-31-0x0000000003D80000-0x0000000003DD8000-memory.dmp
memory/2300-32-0x0000000003D80000-0x0000000003DD8000-memory.dmp
memory/2300-20-0x0000000001770000-0x0000000001772000-memory.dmp
memory/2300-34-0x0000000003D80000-0x0000000003DD8000-memory.dmp
memory/2300-35-0x00000000031E0000-0x00000000031FC000-memory.dmp
memory/2300-50-0x0000000001180000-0x0000000001280000-memory.dmp
memory/5764-39-0x0000000001120000-0x000000000113C000-memory.dmp
memory/5764-40-0x0000000001120000-0x000000000113C000-memory.dmp
memory/5764-42-0x0000000001120000-0x000000000113C000-memory.dmp
memory/5764-43-0x0000000003B50000-0x0000000003BA8000-memory.dmp
memory/5764-44-0x0000000003B50000-0x0000000003BA8000-memory.dmp
memory/5764-46-0x0000000003B50000-0x0000000003BA8000-memory.dmp
memory/5764-45-0x0000000003B50000-0x0000000003BA8000-memory.dmp
memory/5764-47-0x0000000003B50000-0x0000000003BA8000-memory.dmp
memory/5764-48-0x0000000001120000-0x000000000113C000-memory.dmp
memory/5764-38-0x0000000001120000-0x000000000113C000-memory.dmp