Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 13:45
General
- Target 2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat.exe
- Size 2.6MB
- Sample260712-q2rxeaaz5n
- SHA256 0f1f37e7ce169ea992084a8dafa8b68fcfb1e259f009124c40ce072cef16b48c
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
155.117.98.111:12854
-
127.0.0.1:8888
-
127.0.0.1:80
-
campaign_date
2026. 7. 4
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Deletes itself 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_32e04b3d9d26c1a2087d349be3f29ff0_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\golang\Zp5Tm\2kB7\aLmI\tmp_F091\svchostx.exe"C:\golang\Zp5Tm\2kB7\aLmI\tmp_F091\svchostx.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\golang\Zp5Tm\2kB7\aLmI\tmp_F091\svchostx.exeC:\golang\Zp5Tm\2kB7\aLmI\tmp_F091\svchostx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
AliyunWrap.dll
AliyunWrap_original.dll
edge_prefs.dat
edgestore.dll
res_bg.bmp
res_icon.bmp
svchostx.exe
memory/4732-50-0x000002765B0B0000-0x000002765B0E4000-memory.dmp
memory/4732-56-0x000002765B0B0000-0x000002765B0E4000-memory.dmp
memory/4732-32-0x0000000180000000-0x0000000180020000-memory.dmp
memory/4732-26-0x0000000180000000-0x0000000180020000-memory.dmp
memory/4732-34-0x0000000180000000-0x0000000180020000-memory.dmp
memory/4732-49-0x000002765B0B0000-0x000002765B0E4000-memory.dmp
memory/4732-43-0x000002765B0B0000-0x000002765B0E4000-memory.dmp
memory/4732-35-0x0000000180000000-0x0000000180020000-memory.dmp
memory/4732-52-0x000002765B0B0000-0x000002765B0E4000-memory.dmp
memory/4732-53-0x000002765B0B0000-0x000002765B0E4000-memory.dmp
memory/4732-54-0x000002765B650000-0x000002765B6A2000-memory.dmp
memory/4732-33-0x0000000180000000-0x0000000180020000-memory.dmp
memory/4732-57-0x000002765B650000-0x000002765B6A2000-memory.dmp
memory/4732-55-0x000002765B0B0000-0x000002765B0E4000-memory.dmp
memory/4732-59-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-58-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-60-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-61-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-62-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-64-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-63-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-69-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-70-0x000002765B6B0000-0x000002765B709000-memory.dmp
memory/4732-71-0x000002765B6B0000-0x000002765B709000-memory.dmp