Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tax disputes.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax disputes.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target Tax disputes.exe
- Size 353KB
- Sample260709-srh8macx6p
- SHA256 eacd951ae2802c2155324a1d4f6f1671a99e989e89940b46f0a19ff1a42bfd05
- MD5 1f25c80605bce120ff872da6339e1718
- SHA1 5d9f8a447dcdb00a5fe0632dc7a3349ee3a284d6
- SHA512 6478c06e000c9549770230ddb118df35cf96e147ac2b49f423e150b2952e551b590af209d1edbdb04ac25a90da0dd2117445c964fe49620242883ae3061ad7e8
- SSDEEP 6144:aHYi8Vs8l76uzLjOVipROEvi13cB5LWDkRvCMRUonF+Io+XhpapRxhr:9s856WjOVIi13cfbRKMmoQ1ypaR7r
- TLSH T1EB7423911BA038B4DC4F4D75A4947923BB30B41237F263BF11BCD8414FB6B66AB69D0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
206.238.196.96:5252
-
206.238.196.96:80
Attributes
-
campaign_date
2026. 7. 7
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 1 IoCs
resource yara_rule behavioral2/memory/4180-8-0x000001EADC5A0000-0x000001EADC5F7000-memory.dmp family_valleyrat_stage_2_v2 - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 000011AC0E5916F9.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 000011AC0E5916F9.exe - Deletes itself 1 IoCs
pid Process 4180 000011AC0E5916F9.exe - Executes dropped EXE 1 IoCs
pid Process 4180 000011AC0E5916F9.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 000011AC0E5916F9.exe File opened (read-only) \??\U: 000011AC0E5916F9.exe File opened (read-only) \??\X: 000011AC0E5916F9.exe File opened (read-only) \??\J: 000011AC0E5916F9.exe File opened (read-only) \??\N: 000011AC0E5916F9.exe File opened (read-only) \??\P: 000011AC0E5916F9.exe File opened (read-only) \??\W: 000011AC0E5916F9.exe File opened (read-only) \??\H: 000011AC0E5916F9.exe File opened (read-only) \??\K: 000011AC0E5916F9.exe File opened (read-only) \??\M: 000011AC0E5916F9.exe File opened (read-only) \??\R: 000011AC0E5916F9.exe File opened (read-only) \??\T: 000011AC0E5916F9.exe File opened (read-only) \??\V: 000011AC0E5916F9.exe File opened (read-only) \??\Y: 000011AC0E5916F9.exe File opened (read-only) \??\Z: 000011AC0E5916F9.exe File opened (read-only) \??\G: 000011AC0E5916F9.exe File opened (read-only) \??\I: 000011AC0E5916F9.exe File opened (read-only) \??\L: 000011AC0E5916F9.exe File opened (read-only) \??\S: 000011AC0E5916F9.exe File opened (read-only) \??\B: 000011AC0E5916F9.exe File opened (read-only) \??\D: 000011AC0E5916F9.exe File opened (read-only) \??\O: 000011AC0E5916F9.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe 4180 000011AC0E5916F9.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4180 000011AC0E5916F9.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4524 wrote to memory of 4180 4524 Tax disputes.exe 88 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax disputes.exe"C:\Users\Admin\AppData\Local\Temp\Tax disputes.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\000011AC0E5916F9.exe"C:\Users\Admin\AppData\Local\Temp\000011AC0E5916F9.exe" --child "C:\Users\Admin\AppData\Local\Temp\Tax disputes.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4180
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\kernelquick.sys
- Size 30B
- SHA256 6b4bbbce480fbc50d39a8ec4b72cdb7d781b151921e063dd899fd9b736adcf68
- MD5 ae50b29a0b8dcc411f24f1863b0eafde
- SHA1 d415a55627b1aded8e4b2cbba402f816b0461155
- SHA512 d9a9ba42d99be32d26667060be1d523dcd20eafa187a67f7919002cc6da349fd058053c9c6f721d6fdb730ea02fbaa3013e51c0c653368bd6b3f57a4c0fcaba8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\000011AC0E5916F9.exe
- Size 353KB
- SHA256 eacd951ae2802c2155324a1d4f6f1671a99e989e89940b46f0a19ff1a42bfd05
- MD5 1f25c80605bce120ff872da6339e1718
- SHA1 5d9f8a447dcdb00a5fe0632dc7a3349ee3a284d6
- SHA512 6478c06e000c9549770230ddb118df35cf96e147ac2b49f423e150b2952e551b590af209d1edbdb04ac25a90da0dd2117445c964fe49620242883ae3061ad7e8
- SSDEEP 6144:aHYi8Vs8l76uzLjOVipROEvi13cB5LWDkRvCMRUonF+Io+XhpapRxhr:9s856WjOVIi13cfbRKMmoQ1ypaR7r
- TLSH T1EB7423911BA038B4DC4F4D75A4947923BB30B41237F263BF11BCD8414FB6B66AB69D0A
- MD5 SHA1 SHA512 SSDEEP TLSH