Overview

overview

10

Static

static

3

21169e5a0b...63.exe

windows10-2004-x64

10

21169e5a0b...63.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/07/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe
  • Size 1.9MB
  • Sample260706-e2wptadv5n
  • SHA256 21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorcredential_accessdefense_evasiondiscoveryevasionvalleyrat_s2persistenceprivilege_escalationransomwaretrojan

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 154.12.19.70:22011

  • 154.12.19.70:22012

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects ValleyRAT payload 4 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 32 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies firewall policy service 3 TTPs 1 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    defense_evasiontrojan
  • Disables use of System Restore points 1 TTPs
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 12 IoCs
    defense_evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 2 IoCs

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 8 IoCs
    defense_evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies data under HKEY_USERS 19 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe
    "C:\Users\Admin\AppData\Local\Temp\21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe
      "C:\Users\Admin\AppData\Local\Temp\21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Modifies Windows Defender TamperProtection settings
      • Modifies Windows Defender notification settings
      • Modifies firewall policy service
      • Modifies security service
      • UAC bypass
      • Windows security bypass
      • Drops file in Drivers directory
      • Server Software Component: Terminal Services DLL
      • Boot or Logon Autostart Execution: LSASS Driver
      • Loads dropped DLL
      • Windows security modification
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4480
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "gpupdate /force"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\system32\gpupdate.exe
          gpupdate /force
          4⤵
            PID:2732
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "gpupdate /force"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2504
          • C:\Windows\system32\gpupdate.exe
            gpupdate /force
            4⤵
              PID:2480
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - windowsupdate.microsoft.com" dir=out action=block remoteip=windowsupdate.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3280
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - windowsupdate.microsoft.com" dir=out action=block remoteip=windowsupdate.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1860
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - update.microsoft.com" dir=out action=block remoteip=update.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4864
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - update.microsoft.com" dir=out action=block remoteip=update.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2300
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - download.windowsupdate.com" dir=out action=block remoteip=download.windowsupdate.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1520
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - download.windowsupdate.com" dir=out action=block remoteip=download.windowsupdate.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2248
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - download.microsoft.com" dir=out action=block remoteip=download.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5100
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - download.microsoft.com" dir=out action=block remoteip=download.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3864
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - wustat.windows.com" dir=out action=block remoteip=wustat.windows.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1976
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - wustat.windows.com" dir=out action=block remoteip=wustat.windows.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2512
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - ntservicepack.microsoft.com" dir=out action=block remoteip=ntservicepack.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:716
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - ntservicepack.microsoft.com" dir=out action=block remoteip=ntservicepack.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4628
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - stats.microsoft.com" dir=out action=block remoteip=stats.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2720
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - stats.microsoft.com" dir=out action=block remoteip=stats.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1508
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - ars.smartscreen.microsoft.com" dir=out action=block remoteip=ars.smartscreen.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3400
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - ars.smartscreen.microsoft.com" dir=out action=block remoteip=ars.smartscreen.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:808
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - fe2.update.microsoft.com" dir=out action=block remoteip=fe2.update.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3248
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - fe2.update.microsoft.com" dir=out action=block remoteip=fe2.update.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1944
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - fe3.delivery.mp.microsoft.com" dir=out action=block remoteip=fe3.delivery.mp.microsoft.com enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - fe3.delivery.mp.microsoft.com" dir=out action=block remoteip=fe3.delivery.mp.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4120
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block WU - tsfe.trafficshaping.dsp.mp.microsoft.com" dir=out action=block remoteip=tsfe.trafficshaping.dsp.mp.microsoft.com enable=yes"
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:4640
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block WU - tsfe.trafficshaping.dsp.mp.microsoft.com" dir=out action=block remoteip=tsfe.trafficshaping.dsp.mp.microsoft.com enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2120
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh advfirewall firewall add rule name="Block Windows Update Service" dir=out action=block program="C:\Windows\system32\svchost.exe" service=wuauserv enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4024
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="Block Windows Update Service" dir=out action=block program="C:\Windows\system32\svchost.exe" service=wuauserv enable=yes
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3844
      • C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
        C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
        1⤵
        • Executes dropped EXE
        PID:2484
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k KillService -s KillService
        1⤵
        • Modifies Windows Defender Real-time Protection settings
        • Modifies Windows Defender TamperProtection settings
        • Modifies Windows Defender notification settings
        • Windows security bypass
        • Boot or Logon Autostart Execution: LSASS Driver
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Windows\system32\conhost.exe
          "C:\Windows\system32\conhost.exe"
          2⤵
          • Enumerates connected drives
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4708
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe
            3⤵
              PID:3508
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "gpupdate /force"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:680
            • C:\Windows\system32\gpupdate.exe
              gpupdate /force
              3⤵
                PID:4512
          • C:\Windows\TEMP\drv_BootRepair.sys
            C:\Windows\TEMP\drv_BootRepair.sys
            1⤵
            • Executes dropped EXE
            PID:3060

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                LSASS Driver

                1
                T1547.008

                Create or Modify System Process

                6
                T1543

                Windows Service

                6
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Server Software Component

                1
                T1505

                Terminal Services DLL

                1
                T1505.005

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                1
                T1547

                LSASS Driver

                1
                T1547.008

                Create or Modify System Process

                6
                T1543

                Windows Service

                6
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Impair Defenses

                8
                T1562

                Disable or Modify System Firewall

                2
                T1562.004

                Disable or Modify Tools

                6
                T1562.001

                Modify Registry

                9
                T1112

                Credential Access

                OS Credential Dumping

                1
                T1003

                LSASS Memory

                1
                T1003.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                2
                T1082

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Inhibit System Recovery

                1
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Svchost.dll
                • Path C:\ProgramData\OpenraVPN\Svchost.dll
                • Size 1.0MB
                • SHA256 b36076e014dd3ab2b7917a0a9d1c3e1669e33cde68e16110d25f13de7c9dfb9a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                drv_BootRepair.sys
                • Path C:\Users\Admin\AppData\Local\Temp\drv_BootRepair.sys
                • Size 29KB
                • SHA256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4708-17-0x0000026583C70000-0x0000026583C71000-memory.dmp
                Download

                memory/4708-14-0x0000026583C40000-0x0000026583C69000-memory.dmp
                Download

                memory/4708-16-0x0000026583C40000-0x0000026583C69000-memory.dmp
                Download

                memory/4708-15-0x0000026583C40000-0x0000026583C69000-memory.dmp
                Download

                memory/4708-13-0x00000265FF540000-0x00000265FF541000-memory.dmp
                Download

                memory/4708-18-0x0000026583C40000-0x0000026583C69000-memory.dmp
                Download

                memory/4708-19-0x0000026583F80000-0x0000026583FCD000-memory.dmp
                Download

                memory/4708-20-0x0000026583F80000-0x0000026583FCD000-memory.dmp
                Download

                memory/4708-23-0x0000026583F80000-0x0000026583FCD000-memory.dmp
                Download

                memory/4708-24-0x0000026583F80000-0x0000026583FCD000-memory.dmp
                Download

                memory/4708-26-0x0000026583C40000-0x0000026583C69000-memory.dmp
                Download

                memory/4708-25-0x0000026583C40000-0x0000026583C69000-memory.dmp
                Download