Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 10:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26422000001257905011_pdf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
26422000001257905011_pdf.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 26422000001257905011_pdf.exe
- Size 27.3MB
- Sample260703-mmcmdsfv4x
- SHA256 7bb8ff1a5d1262d63167c0db64c00ae1965671c5168720fda081ca62d41d57d3
- MD5 608646f448c0a5c26a34c79fcec2257a
- SHA1 3f033e89ee8e868c4ca228c45225428c9a89b6b6
- SHA512 17274c72d46b74d5cfd347bf12f01aca92d35df546db52986cd47239ab0a457f69af645c77038bbe626ef41d5ca096649c307f026832063b3e82bd5c443d5e79
- SSDEEP 393216:widnRPx6mz6JixSJ4wqUsXp95IA2KzyHwKawW11JOR24LaI74H/KxpY9ZN+:wi6ivwqU88QKTag2iaIhwN+
- TLSH T10B5733B86FED12E9D03B66BEBD44F6031796A4ECBEC5C84833C0684689D6E87CC465C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
fgqwt02.cn:447
-
127.0.0.1:447
Attributes
-
campaign_date
2026. 7. 2
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 4 IoCs
resource yara_rule behavioral2/memory/1472-73-0x0000000002DA0000-0x0000000002DDC000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1472-74-0x0000000002DA0000-0x0000000002DDC000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1472-75-0x0000000002DA0000-0x0000000002DDC000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1472-76-0x0000000002DA0000-0x0000000002DDC000-memory.dmp family_valleyrat_stage_2_v2 - Executes dropped EXE 2 IoCs
pid Process 1352 irsetup.exe 1472 ZwConversionOleID.exe - Loads dropped DLL 5 IoCs
pid Process 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: ZwConversionOleID.exe File opened (read-only) \??\S: ZwConversionOleID.exe File opened (read-only) \??\T: ZwConversionOleID.exe File opened (read-only) \??\U: ZwConversionOleID.exe File opened (read-only) \??\V: ZwConversionOleID.exe File opened (read-only) \??\L: ZwConversionOleID.exe File opened (read-only) \??\N: ZwConversionOleID.exe File opened (read-only) \??\O: ZwConversionOleID.exe File opened (read-only) \??\X: ZwConversionOleID.exe File opened (read-only) \??\B: ZwConversionOleID.exe File opened (read-only) \??\H: ZwConversionOleID.exe File opened (read-only) \??\I: ZwConversionOleID.exe File opened (read-only) \??\K: ZwConversionOleID.exe File opened (read-only) \??\Q: ZwConversionOleID.exe File opened (read-only) \??\R: ZwConversionOleID.exe File opened (read-only) \??\W: ZwConversionOleID.exe File opened (read-only) \??\Y: ZwConversionOleID.exe File opened (read-only) \??\D: ZwConversionOleID.exe File opened (read-only) \??\G: ZwConversionOleID.exe File opened (read-only) \??\M: ZwConversionOleID.exe File opened (read-only) \??\Z: ZwConversionOleID.exe File opened (read-only) \??\J: ZwConversionOleID.exe -
resource yara_rule behavioral2/files/0x000e00000001c628-3.dat upx behavioral2/memory/1352-5-0x0000000000400000-0x0000000000527000-memory.dmp upx behavioral2/memory/1352-59-0x0000000000400000-0x0000000000527000-memory.dmp upx - Drops file in Program Files directory 41 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\ZwUInfo.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\mfc90.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\msvcp100.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\msvcr100.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\msvcr100.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\NCSEcw4_RO.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\msvcr120d.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\ZwConversionOleIDRes.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\ZwUInfo.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\mfc100u.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\msvcp100.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\NCSEcw4_RO.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\1.TXT irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\ZwConversionOleIDRes.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\mfc90u.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\mfc90u.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\SpaACIS.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\3.TXT irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\msvcr120.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\proxy.exe irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\vcruntime140.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\UnknownWindowsVersions.txt ZwConversionOleID.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\NCSEcw.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\NCSEcw.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\pdflib.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\ZwConversionOleID.exe irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\msvcp120.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\proxy.exe irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\vcruntime140.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\msvcp120.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\msvcr120d.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\1.TXT irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\msvcp120d.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\ZwConversionOleID.exe irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\mfc100u.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\mfc90.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\pdflib.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\SpaACIS.dll irsetup.exe File created C:\Program Files (x86)\ZWCAD+ 2015\3.TXT irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\msvcr120.dll irsetup.exe File opened for modification C:\Program Files (x86)\ZWCAD+ 2015\msvcp120d.dll irsetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26422000001257905011_pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZwConversionOleID.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ irsetup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe 1472 ZwConversionOleID.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1352 irsetup.exe 1352 irsetup.exe 1472 ZwConversionOleID.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5980 wrote to memory of 1352 5980 26422000001257905011_pdf.exe 89 PID 1352 wrote to memory of 1472 1352 irsetup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\26422000001257905011_pdf.exe"C:\Users\Admin\AppData\Local\Temp\26422000001257905011_pdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe__IRAOFF:520716 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\26422000001257905011_pdf.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Program Files (x86)\ZWCAD+ 2015\ZwConversionOleID.exe"C:\Program Files (x86)\ZWCAD+ 2015\ZwConversionOleID.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\ZWCAD+ 2015\MSVCR100.dll
- Size 752KB
- SHA256 1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
- MD5 67ec459e42d3081dd8fd34356f7cafc1
- SHA1 1738050616169d5b17b5adac3ff0370b8c642734
- SHA512 9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
- SSDEEP 12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
- TLSH T16DF49D11B692C073C57220300629D7B24D7BB9711434986BBBD99F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ZWCAD+ 2015\VCRUNTIME140.dll
- Size 120KB
- SHA256 2fa6efc053203460a23d3a25158f227d895d2dadc63acc1a372da97c3a4281c3
- MD5 d1db57f77b5ace5876b20608312f0f4e
- SHA1 0d69c0c189b23c24b14e045c8a842d923a9874e2
- SHA512 2cc1f7e8d90bf0d4afc47e58d8b9e055ebb061a3307095b15cee3691455d874c073fcbfe135411d3fe86742ac7bb6957d85910f34fb70a71a0a6b3ea91fb300a
- SSDEEP 3072:jZG8PNVWuv2eeMesPUkWJ7vZxLUPLlsecbVpMeaxoWDd:jg8PNwuv2e3UkWZvbLUPCecbVe5Si
- TLSH T1B6C38D507184C177D8EA90B491BFBA273C794A114BA047CB7FD49C849E38BE1BB3964B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ZWCAD+ 2015\ZwConversionOleID.exe
- Size 174KB
- SHA256 16b4a67e572195f534548d2efa822a7a0106719ab7627c3a8a6fe91487280ca6
- MD5 29e4b922244f64a4bad4d2e2e40e5688
- SHA1 7d26b32e65f5d9028bf09ba0ea3a425981fe5aaa
- SHA512 7113c13c58a0d345109687cfb7b9e3877248078dda0c45874ba251fe4472ef415fe1e26bea8aa40b76e36c9fc0c519dcc5fed1196084948c41c25b99486514a6
- SSDEEP 3072:8AJF7ERYNuOVCSoAMHnSDO+h5aM5uJHyf:zER8uigHqOY50q
- TLSH T19B04A01AA54280E1E6D943F0CBABD665036B6D205B2905F7376CFD491B7C2C17E3B28B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ZWCAD+ 2015\ZwUInfo.dll
- Size 25KB
- SHA256 c94ea7690033298c899e21102851f6db84e0d1cdedb9a8a67a8706d95fa6c04f
- MD5 50ee7287d06fecd5cf42e06b984d42e2
- SHA1 723299f62edf0ccf19769b4772d606c4b3f2c62e
- SHA512 4f6d40289f7e500d5f7833fdb2757de3028e6ac47239b3c178efbf5a41da0279e87a277a65b641674040db113033fc9b2f2248c03b175de2d2566d82b62683cb
- SSDEEP 384:SagcsmP8wfIGbNiohx8u8InPV5IalyXj2nYPLXjeMp:SaEmPlVi4R9ndrM2A
- TLSH T157C22A05AF041462D6A14930B5A6A227587CFC362BC910CB97D74D8A2CB87E3B735F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ZWCAD+ 2015\mfc100u.dll
- Size 589KB
- SHA256 9e5ffb1c409e95eff5d01e3080ed6ab8bae1ced58efbc2022a4f0227b04277bd
- MD5 c0a9c50696aa5ef2864c4b3a4d3a3840
- SHA1 d7058494092ab0f54bed3a13458a1f5ad49c633b
- SHA512 3a5300392e731fff1b787ae2582e11e1127664899d7239fd65b2d1adfee528e569066f495aebb3906085aab3fdc2d03ee4b32a44e9a5178e82291313b1ca1752
- SSDEEP 6144:E9mK5w1qJgLtstjmOwawb3nm032xILqlsrVNLkClep:E9mK5w3tsmrrJVNLzgp
- TLSH T14CD42A493210EB71B3C66D7CB6FB7B0894258357673403C7BDE31A98A359ADAC27A1C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ZWCAD+ 2015\proxy.exe
- Size 2KB
- SHA256 1f66c2fe28ee7558d858caafd50df716930490b4e882d30e5ca198e0b4283ba0
- MD5 b522351aa3f1becc079b396f0ae9bea8
- SHA1 07a52448a8ca1ac7b2b1b05b1a63362c4b1523fe
- SHA512 7fd04b6a7ec990ce7c9622e136a5c03cee4a83aacd6c782401f15ae47dd4b077338a2b93ea1f18875195d380f8c4579dea4feb751dcafbaa42aaca4660d2f5fe
- TLSH T17F4185101989199E8BFDFA1E7529082DA44437D21ED3144B23E1F3BE5BDB847265F9C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
- Size 440KB
- SHA256 d95b5bf9ca97c1900de5357743282bab655d61d616606485088e1708559b7cf1
- MD5 75ca7ff96bf5a316c3af2de6a412bd54
- SHA1 0a093950790ff0dddff6f5f29c6b02c10997e0c5
- SHA512 b8da86f2f1e908955254e5168d0447f479cec7815a8b081a7b38eb87187cb2eb992109c67e006361b96bc1529ee8abc9dc477d78e9ca565e43f5415b492771d4
- SSDEEP 6144:JgHXCFdoW/HotZk9K0C4mXE7EbmSIPzjZivhzO2PJehlNAI04Jl47sHvEh4UjfzS:cyIIIzAClE7uDOch+h2ul/mJo
- TLSH T1E8A4238B77B62D61C0AC4E3124672221FA75ED7DA880472E57D8FC5F1EF4912483FA4A
- MD5 SHA1 SHA512 SSDEEP TLSH