Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 02:26
General
- Target 商城7800万美金聊天记录g.exe
- Size 2.3MB
- Sample260702-cwt8pabs7w
- SHA256 a372c6797c7dd896a09b02333de191a2f3eca4ac3ae3786f3f45f67dc27445b6
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
134.122.129.88:6666
-
134.122.129.88:8888
-
127.0.0.1:80
-
campaign_date
2026. 6. 5
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\商城7800万美金聊天记录g.exe"C:\Users\Admin\AppData\Local\Temp\商城7800万美金聊天记录g.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"C:\Users\Public\test\chasgdf3t\rtyrtfd.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
IOCPTcp.dll
boot.log
rtyrtfd20260702.log
rtyrtfd.exe
memory/896-45-0x0000000003B80000-0x0000000003BD8000-memory.dmp
memory/896-48-0x0000000001160000-0x000000000117C000-memory.dmp
memory/896-36-0x0000000001160000-0x000000000117C000-memory.dmp
memory/896-43-0x0000000003B80000-0x0000000003BD8000-memory.dmp
memory/896-49-0x0000000001160000-0x000000000117C000-memory.dmp
memory/896-44-0x0000000003B80000-0x0000000003BD8000-memory.dmp
memory/896-42-0x0000000003B80000-0x0000000003BD8000-memory.dmp
memory/896-41-0x0000000003B80000-0x0000000003BD8000-memory.dmp
memory/896-40-0x0000000001160000-0x000000000117C000-memory.dmp
memory/896-38-0x0000000001160000-0x000000000117C000-memory.dmp
memory/896-37-0x0000000001160000-0x000000000117C000-memory.dmp
memory/1600-22-0x0000000001440000-0x000000000145C000-memory.dmp
memory/1600-24-0x0000000001440000-0x000000000145C000-memory.dmp
memory/1600-33-0x0000000004230000-0x0000000004288000-memory.dmp
memory/1600-35-0x0000000004230000-0x0000000004288000-memory.dmp
memory/1600-32-0x0000000004230000-0x0000000004288000-memory.dmp
memory/1600-31-0x0000000004230000-0x0000000004288000-memory.dmp
memory/1600-30-0x0000000004230000-0x0000000004288000-memory.dmp
memory/1600-29-0x0000000001660000-0x0000000001760000-memory.dmp
memory/1600-28-0x0000000001440000-0x000000000145C000-memory.dmp
memory/1600-34-0x0000000004230000-0x0000000004288000-memory.dmp
memory/1600-25-0x0000000001440000-0x000000000145C000-memory.dmp
memory/1600-23-0x0000000001440000-0x000000000145C000-memory.dmp
memory/1600-21-0x0000000003AD0000-0x0000000003B51000-memory.dmp
memory/1600-47-0x0000000001440000-0x000000000145C000-memory.dmp
memory/1600-20-0x0000000001490000-0x0000000001492000-memory.dmp
memory/1600-19-0x0000000001490000-0x0000000001492000-memory.dmp
memory/1600-50-0x0000000001660000-0x0000000001760000-memory.dmp