Analysis
- max time kernel
106s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 16:27
General
- Target 2hao.exe
- Size 349KB
- Sample260710-tycvvsfs8t
- SHA256 d95b179001682c28bdadf09f6e344285562d68f15a2194b0234117de3c5e8408
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.243.36.18:5252
-
47.243.36.18:80
-
campaign_date
2026. 7. 7
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 9 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 6 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 56 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2hao.exe"C:\Users\Admin\AppData\Local\Temp\2hao.exe"2⤵
- Windows security bypass
- Windows security modification
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\7766cnsc\09mup3d9.exeC:\ProgramData\EdgeUpdate\7766cnsc\09mup3d9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\6m5emukv\sa0d84mk.exeC:\ProgramData\EdgeUpdate\6m5emukv\sa0d84mk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\czxn7ok4\63z3tohy.exeC:\ProgramData\EdgeUpdate\czxn7ok4\63z3tohy.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\z5ya6kwv\jr1amf69.exeC:\ProgramData\EdgeUpdate\z5ya6kwv\jr1amf69.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\63ibrf55\ptevz289.exeC:\ProgramData\EdgeUpdate\63ibrf55\ptevz289.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\0vbfjweo\wnla6p09.exeC:\ProgramData\EdgeUpdate\0vbfjweo\wnla6p09.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\rjr2w5rj\e2u6zrzy.exeC:\ProgramData\EdgeUpdate\rjr2w5rj\e2u6zrzy.exe1⤵
-
C:\ProgramData\EdgeUpdate\gz65ir6t\vnf1jftm.exeC:\ProgramData\EdgeUpdate\gz65ir6t\vnf1jftm.exe1⤵
-
C:\ProgramData\EdgeUpdate\jaany3qk\iffgqj3s.exeC:\ProgramData\EdgeUpdate\jaany3qk\iffgqj3s.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
09mup3d9.exe
config.log
webview_support.dll
kernelquick.sys
memory/2988-3-0x0000021998630000-0x0000021998687000-memory.dmp
memory/2988-2-0x0000021998630000-0x0000021998687000-memory.dmp
memory/2988-4-0x0000021998630000-0x0000021998687000-memory.dmp
memory/2988-5-0x0000021998630000-0x0000021998687000-memory.dmp
memory/2988-8-0x0000021998630000-0x0000021998687000-memory.dmp
memory/2988-10-0x0000000180000000-0x00000001800EE000-memory.dmp
memory/2988-0-0x00000219985E0000-0x0000021998630000-memory.dmp
memory/4880-113-0x00000000089E0000-0x0000000008A37000-memory.dmp
memory/4880-165-0x00000000040E0000-0x00000000040E1000-memory.dmp
memory/4880-35-0x0000000004350000-0x00000000043A7000-memory.dmp
memory/4880-38-0x0000000004350000-0x00000000043A7000-memory.dmp
memory/4880-33-0x0000000004350000-0x00000000043A7000-memory.dmp
memory/4880-42-0x0000000004350000-0x00000000043A7000-memory.dmp
memory/4880-59-0x0000000001690000-0x0000000001691000-memory.dmp
memory/4880-67-0x0000000007320000-0x0000000007377000-memory.dmp
memory/4880-68-0x0000000007320000-0x0000000007377000-memory.dmp
memory/4880-72-0x0000000007320000-0x0000000007377000-memory.dmp
memory/4880-73-0x0000000007320000-0x0000000007377000-memory.dmp
memory/4880-76-0x0000000007320000-0x0000000007377000-memory.dmp
memory/4880-93-0x0000000003B70000-0x0000000003B71000-memory.dmp
memory/4880-103-0x00000000089E0000-0x0000000008A37000-memory.dmp
memory/4880-104-0x00000000089E0000-0x0000000008A37000-memory.dmp
memory/4880-106-0x00000000089E0000-0x0000000008A37000-memory.dmp
memory/4880-107-0x00000000089E0000-0x0000000008A37000-memory.dmp
memory/4880-32-0x0000000004350000-0x00000000043A7000-memory.dmp
memory/4880-128-0x00000000040D0000-0x00000000040D1000-memory.dmp
memory/4880-139-0x0000000009940000-0x0000000009997000-memory.dmp
memory/4880-143-0x0000000009940000-0x0000000009997000-memory.dmp
memory/4880-144-0x0000000009940000-0x0000000009997000-memory.dmp
memory/4880-149-0x0000000009940000-0x0000000009997000-memory.dmp
memory/4880-34-0x0000000003B10000-0x0000000003B11000-memory.dmp
memory/4880-175-0x000000000AA90000-0x000000000AAE7000-memory.dmp
memory/4880-179-0x000000000AA90000-0x000000000AAE7000-memory.dmp
memory/4880-180-0x000000000AA90000-0x000000000AAE7000-memory.dmp
memory/4880-183-0x000000000AA90000-0x000000000AAE7000-memory.dmp
memory/4880-199-0x0000000003CE0000-0x0000000003CE1000-memory.dmp
memory/4880-210-0x0000000006600000-0x0000000006657000-memory.dmp
memory/4880-212-0x0000000006600000-0x0000000006657000-memory.dmp
memory/4880-214-0x0000000006600000-0x0000000006657000-memory.dmp
memory/4880-217-0x0000000006600000-0x0000000006657000-memory.dmp
memory/4880-233-0x0000000004110000-0x0000000004111000-memory.dmp
memory/4880-243-0x000000000ED20000-0x000000000ED77000-memory.dmp
memory/4880-247-0x000000000ED20000-0x000000000ED77000-memory.dmp
memory/4880-250-0x000000000ED20000-0x000000000ED77000-memory.dmp
memory/4880-254-0x000000000ED20000-0x000000000ED77000-memory.dmp
memory/4880-270-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4880-279-0x000000000F320000-0x000000000F377000-memory.dmp
memory/4880-281-0x000000000F320000-0x000000000F377000-memory.dmp
memory/4880-285-0x000000000F320000-0x000000000F377000-memory.dmp
memory/4880-289-0x000000000F320000-0x000000000F377000-memory.dmp
memory/4880-305-0x0000000003D50000-0x0000000003D51000-memory.dmp
memory/4880-315-0x000000000FFF0000-0x0000000010047000-memory.dmp
memory/4880-317-0x000000000FFF0000-0x0000000010047000-memory.dmp
memory/4880-319-0x000000000FFF0000-0x0000000010047000-memory.dmp