Analysis
- max time kernel
149s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 04:39
General
- Target 2026-07-11_4b52ca7fe81d3b59e9d7f03ac8501f9e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
- Size 962KB
- Sample260711-e9yjdadz7w
- SHA256 0e20982c6967ef2aa72df71cd6c42590c2387b0117abe4ee7990df6c8022d510
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 36 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_4b52ca7fe81d3b59e9d7f03ac8501f9e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_4b52ca7fe81d3b59e9d7f03ac8501f9e_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"1⤵
- Downloads MZ/PE file
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\WindowsUpdateDir\obs.exe"C:\Users\Admin\Downloads\WindowsUpdateDir\obs.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\obs\obs.exe"C:\ProgramData\obs\obs.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\ProgramData\obs\" && start /B "" "C:\ProgramData\obs\obs.exe" && exit"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\obs\obs.exe"C:\ProgramData\obs\obs.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
libcef.dll
obs.exe
obs_start.tmp
memory/1788-85-0x000001F1AD2C0000-0x000001F1AD2C1000-memory.dmp
memory/1788-88-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-91-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-92-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-89-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-90-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-93-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-95-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-96-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-99-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-101-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-108-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-110-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-109-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-107-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-106-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-105-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-103-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-102-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-100-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-98-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-97-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-104-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-111-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-113-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-114-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/1788-116-0x000001F1AD6D0000-0x000001F1AD708000-memory.dmp
memory/1788-118-0x000001F1AD990000-0x000001F1AD9F6000-memory.dmp
memory/5916-124-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-125-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-123-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-122-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-126-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-127-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-129-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-130-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-135-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-144-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-143-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-142-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-141-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-140-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-139-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-137-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-136-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-134-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-133-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-132-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-131-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-138-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-145-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-147-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-148-0x000001C14E630000-0x000001C14E696000-memory.dmp
memory/5916-151-0x000001C14DE90000-0x000001C14DEC8000-memory.dmp
memory/5916-154-0x000001C14E630000-0x000001C14E696000-memory.dmp