Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/07/2026, 01:58
General
- Target 2026-07-05_066732c06fbac8528c1db82f25cfedf5_cobalt-strike_icedid_satacom_stealc_vidar.exe
- Size 7.4MB
- Sample260705-cdt5zagv8s
- SHA256 914eec67344c3d5389b4d8b3348deec7b7fd78b53db278cdd86d6169ceb59c21
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
192.253.229.177:447
-
192.253.229.177:448
-
127.0.0.1:80
-
campaign_date
2026. 6.17
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- UAC bypass 3 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_066732c06fbac8528c1db82f25cfedf5_cobalt-strike_icedid_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_066732c06fbac8528c1db82f25cfedf5_cobalt-strike_icedid_satacom_stealc_vidar.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\YourApp\wechatweb.exe"C:\Users\Admin\AppData\Local\YourApp\wechatweb.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\schtasks.exeschtasks /query /tn "Startup_1exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /query /tn "Startup_1exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\YourApp\Home Renovation Style Design Plans.pptx" /ou ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\YourApp\wechatweb.exeC:\Users\Admin\AppData\Local\YourApp\wechatweb.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 4882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3520 -ip 35201⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
Home Renovation Style Design Plans.pptx
qbcore.dll
wechatweb.exe
资料.txt
上线信息.ini
memory/3404-70-0x0000000003410000-0x00000000034DD000-memory.dmp
memory/3404-48-0x0000000003410000-0x00000000034DD000-memory.dmp
memory/3404-51-0x0000000003410000-0x00000000034DD000-memory.dmp
memory/3404-65-0x0000000003410000-0x00000000034DD000-memory.dmp
memory/3404-49-0x0000000003410000-0x00000000034DD000-memory.dmp
memory/3404-71-0x0000000010000000-0x000000001009F000-memory.dmp
memory/3404-62-0x0000000003410000-0x00000000034DD000-memory.dmp
memory/3404-66-0x0000000003410000-0x00000000034DD000-memory.dmp
memory/3404-47-0x0000000010000000-0x000000001009F000-memory.dmp
memory/3404-45-0x0000000010000000-0x000000001009F000-memory.dmp
memory/3404-46-0x0000000010000000-0x000000001009F000-memory.dmp
memory/3404-72-0x0000000010000000-0x000000001009F000-memory.dmp
memory/3404-41-0x0000000010000000-0x000000001009F000-memory.dmp
memory/3404-36-0x0000000010000000-0x000000001009F000-memory.dmp
memory/3904-32-0x00007FFB60930000-0x00007FFB60940000-memory.dmp
memory/3904-19-0x00007FFB62990000-0x00007FFB629A0000-memory.dmp
memory/3904-22-0x00007FFBA29AD000-0x00007FFBA29AE000-memory.dmp
memory/3904-20-0x00007FFB62990000-0x00007FFB629A0000-memory.dmp
memory/3904-21-0x00007FFB62990000-0x00007FFB629A0000-memory.dmp
memory/3904-33-0x00007FFB60930000-0x00007FFB60940000-memory.dmp
memory/3904-23-0x00007FFB62990000-0x00007FFB629A0000-memory.dmp
memory/3904-26-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp
memory/3904-28-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp
memory/3904-30-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp
memory/3904-31-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp
memory/3904-29-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp
memory/3904-27-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp
memory/3904-24-0x00007FFB62990000-0x00007FFB629A0000-memory.dmp
memory/3904-25-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp
memory/3904-73-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp