Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 02:26
General
- Target 商城7800万美金聊天记录g.exe
- Size 2.3MB
- Sample260702-cwt8pabs7w
- SHA256 a372c6797c7dd896a09b02333de191a2f3eca4ac3ae3786f3f45f67dc27445b6
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
134.122.129.88:6666
-
134.122.129.88:8888
-
127.0.0.1:80
-
campaign_date
2026. 6. 5
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\商城7800万美金聊天记录g.exe"C:\Users\Admin\AppData\Local\Temp\商城7800万美金聊天记录g.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
IOCPTcp.dll
boot.log
rtyrtfd20260702.log
rtyrtfd.exe
memory/2484-35-0x0000000003630000-0x0000000003688000-memory.dmp
memory/2484-36-0x0000000003630000-0x0000000003688000-memory.dmp
memory/2484-24-0x00000000030D0000-0x0000000003151000-memory.dmp
memory/2484-26-0x0000000000BA0000-0x0000000000BBC000-memory.dmp
memory/2484-25-0x0000000000BA0000-0x0000000000BBC000-memory.dmp
memory/2484-27-0x0000000000BA0000-0x0000000000BBC000-memory.dmp
memory/2484-28-0x0000000000BA0000-0x0000000000BBC000-memory.dmp
memory/2484-31-0x0000000000C00000-0x0000000000D00000-memory.dmp
memory/2484-30-0x0000000000BA0000-0x0000000000BBC000-memory.dmp
memory/2484-32-0x0000000003630000-0x0000000003688000-memory.dmp
memory/2484-33-0x0000000003630000-0x0000000003688000-memory.dmp
memory/2484-34-0x0000000003630000-0x0000000003688000-memory.dmp
memory/2484-22-0x00000000009E0000-0x00000000009E2000-memory.dmp
memory/2484-23-0x00000000009E0000-0x00000000009E2000-memory.dmp
memory/2484-37-0x0000000003630000-0x0000000003688000-memory.dmp
memory/2484-38-0x0000000000BA0000-0x0000000000BBC000-memory.dmp
memory/2484-39-0x0000000000BA0000-0x0000000000BBC000-memory.dmp
memory/2484-53-0x0000000000C00000-0x0000000000D00000-memory.dmp
memory/3836-42-0x0000000000F50000-0x0000000000F6C000-memory.dmp
memory/3836-43-0x0000000000F50000-0x0000000000F6C000-memory.dmp
memory/3836-45-0x0000000000F50000-0x0000000000F6C000-memory.dmp
memory/3836-46-0x0000000003AE0000-0x0000000003B38000-memory.dmp
memory/3836-47-0x0000000003AE0000-0x0000000003B38000-memory.dmp
memory/3836-49-0x0000000003AE0000-0x0000000003B38000-memory.dmp
memory/3836-48-0x0000000003AE0000-0x0000000003B38000-memory.dmp
memory/3836-50-0x0000000003AE0000-0x0000000003B38000-memory.dmp
memory/3836-51-0x0000000000F50000-0x0000000000F6C000-memory.dmp
memory/3836-41-0x0000000000F50000-0x0000000000F6C000-memory.dmp