Analysis
- max time kernel
86s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 12:16
General
- Target stpsu_epac.exe
- Size 345KB
- Sample260716-pfjs8scy2p
- SHA256 506ca1e1148669f6cba4e12126d2586480bacc722c6e764cc934e18b1cf32b9a
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.75.103.130:5252
-
47.75.103.130:80
-
campaign_date
2026. 7.16
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 12 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 5 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 50 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\stpsu_epac.exe"C:\Users\Admin\AppData\Local\Temp\stpsu_epac.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00000EE40E593994.exe"C:\Users\Admin\AppData\Local\Temp\00000EE40E593994.exe" --child "C:\Users\Admin\AppData\Local\Temp\stpsu_epac.exe"3⤵
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\EdgeUpdate\lxnv2x71\xez2ti8a.exeC:\ProgramData\EdgeUpdate\lxnv2x71\xez2ti8a.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\s5y7pr8s\iomkgf3g.exeC:\ProgramData\EdgeUpdate\s5y7pr8s\iomkgf3g.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\tdu1gabk\dpfv7rvv.exeC:\ProgramData\EdgeUpdate\tdu1gabk\dpfv7rvv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\yysao3lj\r8et72hs.exeC:\ProgramData\EdgeUpdate\yysao3lj\r8et72hs.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\cvsa9b69\1by8acxn.exeC:\ProgramData\EdgeUpdate\cvsa9b69\1by8acxn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\84mjp070\1jyjk8pu.exeC:\ProgramData\EdgeUpdate\84mjp070\1jyjk8pu.exe1⤵
-
C:\ProgramData\EdgeUpdate\zd6hzi76\dv647eht.exeC:\ProgramData\EdgeUpdate\zd6hzi76\dv647eht.exe1⤵
-
C:\ProgramData\EdgeUpdate\plwxczxf\p4f3fuoz.exeC:\ProgramData\EdgeUpdate\plwxczxf\p4f3fuoz.exe1⤵
-
C:\ProgramData\EdgeUpdate\v8fo59y1\23wte7dt.exeC:\ProgramData\EdgeUpdate\v8fo59y1\23wte7dt.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
webview_support.dll
xez2ti8a.exe
kernelquick.sys
00000EE40E593994.exe
memory/4268-1-0x000002215BA90000-0x000002215BAE0000-memory.dmp
memory/4268-2-0x000002215BB40000-0x000002215BB97000-memory.dmp
memory/4268-3-0x000002215BB40000-0x000002215BB97000-memory.dmp
memory/4268-4-0x000002215BB40000-0x000002215BB97000-memory.dmp
memory/4268-6-0x000002215BB40000-0x000002215BB97000-memory.dmp
memory/4268-8-0x000002215F010000-0x000002215F100000-memory.dmp
memory/4268-9-0x000002215BB40000-0x000002215BB97000-memory.dmp
memory/4268-10-0x000002215BB40000-0x000002215BB97000-memory.dmp
memory/4268-13-0x0000000180000000-0x00000001800EE000-memory.dmp
memory/6084-35-0x0000000006450000-0x00000000064A7000-memory.dmp
memory/6084-36-0x0000000006450000-0x00000000064A7000-memory.dmp
memory/6084-37-0x0000000003390000-0x0000000003391000-memory.dmp
memory/6084-38-0x0000000006450000-0x00000000064A7000-memory.dmp
memory/6084-39-0x0000000006450000-0x00000000064A7000-memory.dmp
memory/6084-44-0x0000000006450000-0x00000000064A7000-memory.dmp
memory/6084-61-0x00000000033B0000-0x00000000033B1000-memory.dmp
memory/6084-69-0x0000000006AC0000-0x0000000006B17000-memory.dmp
memory/6084-70-0x0000000006AC0000-0x0000000006B17000-memory.dmp
memory/6084-74-0x0000000006AC0000-0x0000000006B17000-memory.dmp
memory/6084-75-0x0000000006AC0000-0x0000000006B17000-memory.dmp
memory/6084-79-0x0000000006AC0000-0x0000000006B17000-memory.dmp
memory/6084-96-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/6084-106-0x00000000084B0000-0x0000000008507000-memory.dmp
memory/6084-109-0x00000000084B0000-0x0000000008507000-memory.dmp
memory/6084-110-0x00000000084B0000-0x0000000008507000-memory.dmp
memory/6084-116-0x00000000084B0000-0x0000000008507000-memory.dmp
memory/6084-132-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/6084-140-0x0000000009460000-0x00000000094B7000-memory.dmp
memory/6084-142-0x0000000009460000-0x00000000094B7000-memory.dmp
memory/6084-144-0x0000000009460000-0x00000000094B7000-memory.dmp
memory/6084-152-0x0000000009460000-0x00000000094B7000-memory.dmp
memory/6084-168-0x0000000006580000-0x0000000006581000-memory.dmp
memory/6084-176-0x000000000A410000-0x000000000A467000-memory.dmp
memory/6084-179-0x000000000A410000-0x000000000A467000-memory.dmp
memory/6084-181-0x000000000A410000-0x000000000A467000-memory.dmp
memory/6084-189-0x000000000A410000-0x000000000A467000-memory.dmp
memory/6084-200-0x000000000A410000-0x000000000A467000-memory.dmp
memory/6084-208-0x0000000003900000-0x0000000003901000-memory.dmp
memory/6084-217-0x000000000A6C0000-0x000000000A717000-memory.dmp
memory/6084-219-0x000000000A6C0000-0x000000000A717000-memory.dmp
memory/6084-220-0x000000000A6C0000-0x000000000A717000-memory.dmp
memory/6084-225-0x000000000A6C0000-0x000000000A717000-memory.dmp
memory/6084-241-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/6084-249-0x000000000F870000-0x000000000F8C7000-memory.dmp
memory/6084-251-0x000000000F870000-0x000000000F8C7000-memory.dmp
memory/6084-255-0x000000000F870000-0x000000000F8C7000-memory.dmp
memory/6084-256-0x000000000F870000-0x000000000F8C7000-memory.dmp
memory/6084-262-0x000000000F870000-0x000000000F8C7000-memory.dmp
memory/6084-279-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/6084-287-0x000000000F780000-0x000000000F7D7000-memory.dmp
memory/6084-291-0x000000000F780000-0x000000000F7D7000-memory.dmp
memory/6084-294-0x000000000F780000-0x000000000F7D7000-memory.dmp
memory/6084-300-0x000000000F780000-0x000000000F7D7000-memory.dmp
memory/6084-316-0x00000000065E0000-0x00000000065E1000-memory.dmp
memory/6084-324-0x0000000010540000-0x0000000010597000-memory.dmp
memory/6084-327-0x0000000010540000-0x0000000010597000-memory.dmp
memory/6084-333-0x0000000010540000-0x0000000010597000-memory.dmp
memory/6084-338-0x0000000010540000-0x0000000010597000-memory.dmp