Overview

overview

10

Static

static

3

f92b.pdf.exe

windows10-2004-x64

10

f92b.pdf.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 12:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f92b.pdf.exe
  • Size 8.7MB
  • Sample260702-psby6aas71
  • SHA256 ca66840e7c8c30a572c0489618a57d25474039bc0b44b0955ca4edc9c5d81706
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryvalleyrat_s2pyinstaller

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 192.168.17.143:6666

Attributes
  • campaign_date

    2026. 6.17

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 19 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f92b.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\f92b.pdf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /k start ¹ØÓÚת·¢¼¯ÍŹ«Ë¾¼ÍίÏ·¢µÄ¹ØÓÚ½üÆڲ鴦µÄÄÚ²¿Î¥¹æÎ¥¼ÍÈËÔ±Ãûµ¥¼°Ïà¹Ø´¦ÀíÇé¿öµÄͨ±¨.pdf
      2⤵
        PID:3208
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c C:\Windows\Temp\result.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Windows\Temp\result.exe
          C:\Windows\Temp\result.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1800
          • C:\Users\Admin\AppData\Local\Temp\temp1.tem
            C:\Users\Admin\AppData\Local\Temp\temp1.tem
            4⤵
            • Executes dropped EXE
            PID:5980
          • C:\Users\Admin\AppData\Local\Temp\temp2.tem
            C:\Users\Admin\AppData\Local\Temp\temp2.tem
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2840
            • C:\Users\Admin\AppData\Local\Temp\temp2.tem
              C:\Users\Admin\AppData\Local\Temp\temp2.tem
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:860
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c del outfile.exe
        2⤵
          PID:2824

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            krnln.fnr
            • Path C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr
            • Size 1.1MB
            • SHA256 820d8dd49baed0da44d42555ad361d78e068115661dce72ae6578dcdab6baead
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            81d243bd2c585b0f4821__mypyc.cp38-win32.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\81d243bd2c585b0f4821__mypyc.cp38-win32.pyd
            • Size 177KB
            • SHA256 780091368b6aed8103e69aeb8e31ca0773fc032a48b8a0691b2899f43e532b3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\VCRUNTIME140.dll
            • Size 81KB
            • SHA256 9d8d21022ff9d3f6b81a45209662a4f3481edc2befae0c73b83cf942eab8be25
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_bz2.pyd
            • Size 76KB
            • SHA256 a6af2196c3e73aed881bf5b4acb79009c42cec43ac022716ae760827263f31a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_ctypes.pyd
            • Size 113KB
            • SHA256 dfa3ff393adc61acb74eeda611b6f1dcc42153efa4bacaaa0df31c98dd580a67
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_decimal.pyd
            • Size 222KB
            • SHA256 ba9cf83a6a0889a796ebd67be478c43f184aa76e5e47caaefa7449cc491861a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_hashlib.pyd
            • Size 37KB
            • SHA256 5481444a5c431c26300f9f281bf9bfa5ee233d45d33bc60050dcd987b207bf48
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_lzma.pyd
            • Size 154KB
            • SHA256 600f70916cff70385a751f079fb857c9880d577f3e94255959180cbfa3ad4610
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiprocessing.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_multiprocessing.pyd
            • Size 25KB
            • SHA256 04abf4180f0d39cbf6365b36a9cd41a6a676cd2118b63db97a7dc8898ee8241c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_queue.pyd
            • Size 24KB
            • SHA256 7b5e1f2e2d82878064cf86a3425653759d116c154efe18043d1bfa85bad60d6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_socket.pyd
            • Size 67KB
            • SHA256 f0e11401b417aa7402e93a1eb4b9c594f5bb4522c31f345c28d62752da09b232
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\_ssl.pyd
            • Size 139KB
            • SHA256 0df59391b76171424124490a63bc9ffc3dd3cd489ce8d32855a48ffa2cf6b543
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\base_library.zip
            • Size 707KB
            • SHA256 c02264695fa09c85f1487c4b84d773dae41d1985e55f87ec9613bb26c8c06e9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cacert.pem
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\certifi\cacert.pem
            • Size 230KB
            • SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd.cp38-win32.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\charset_normalizer\cd.cp38-win32.pyd
            • Size 9KB
            • SHA256 b125791a0a3891ae349925013b14fb9f26cf4a1f740dd033056701f1691f3204
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            md.cp38-win32.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\charset_normalizer\md.cp38-win32.pyd
            • Size 9KB
            • SHA256 b75d7afb2625ada908d1080732f96dd9cbb299e3690f1d98d61fef4fdf87d0fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\libcrypto-1_1.dll
            • Size 2.1MB
            • SHA256 3a2dba6098e77e36a9d20c647349a478cb0149020f909665d209f548dfa71377
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\libffi-7.dll
            • Size 28KB
            • SHA256 0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\libssl-1_1.dll
            • Size 525KB
            • SHA256 44a228b3646eb3575abd5cbcb079e018de11ca6b838a29e4391893de69e0cf4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyarmor_runtime.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\pyarmor_runtime_000000\pyarmor_runtime.pyd
            • Size 759KB
            • SHA256 74883628c3a33d2a6fd76d54f104bbe2c79b8f9d967d0289e4bc7f2ae02a5451
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\pyexpat.pyd
            • Size 163KB
            • SHA256 1c492ff46c2c398244d4afe1d40f36b24caf0268d7e25101ee8ceef65767bd9f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python38.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\python38.dll
            • Size 3.9MB
            • SHA256 9352ad4fd0dd430457aa608dc981942bbef6bc8bfae52cf1fc48d89377129903
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\select.pyd
            • Size 23KB
            • SHA256 e56ec0da1d4a50bebb24bccb4cf32125af9b3686a93f22ed6fd39a155a0bb9ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI28402\unicodedata.pyd
            • Size 1.0MB
            • SHA256 4634fff313a08e22031d9a0d31915ea729e7306546bfb8b22a6e65c75e6a644e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            temp1.tem
            • Path C:\Users\Admin\AppData\Local\Temp\temp1.tem
            • Size 130KB
            • SHA256 50c2ec9d9f30021116406e22a884c483d16c1f6db8b804dd3f9501b32dd990f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            temp2.tem
            • Path C:\Users\Admin\AppData\Local\Temp\temp2.tem
            • Size 5.6MB
            • SHA256 224453f7882fb58452e7e892860387dfd1b7cf5cf6a034d474f1aea74b4557ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            result.exe
            • Path C:\Windows\Temp\result.exe
            • Size 6.3MB
            • SHA256 7fbc062b445d9c5fd1f6563b0de36de11a689eb1f237f1277dab397b8e7d04f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/860-87-0x0000000070800000-0x00000000708CB000-memory.dmp
            Download

            memory/1800-46-0x0000000000400000-0x000000000040B000-memory.dmp
            Download

            memory/1800-6-0x0000000000400000-0x000000000040B000-memory.dmp
            Download

            memory/5056-2-0x00007FF6A4C70000-0x00007FF6A5537000-memory.dmp
            Download