Analysis
- max time kernel
89s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 12:01
General
- Target sptsi_yo4o.exe
- Size 346KB
- Sample260717-n7cnkad16w
- SHA256 434cbf2da74d199f1cb40c5c13b9002ee3ec0b2690b277d2333ae63b72863ff5
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.242.198.248:5252
-
47.242.198.248:80
-
campaign_date
2026. 7. 7
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 11 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 6 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Windows security bypass
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sptsi_yo4o.exe"C:\Users\Admin\AppData\Local\Temp\sptsi_yo4o.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\000011C00E5905B3.exe"C:\Users\Admin\AppData\Local\Temp\000011C00E5905B3.exe" --child "C:\Users\Admin\AppData\Local\Temp\sptsi_yo4o.exe"3⤵
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\EdgeUpdate\4k8mjmx9\banhi3sa.exeC:\ProgramData\EdgeUpdate\4k8mjmx9\banhi3sa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\mgk8s7d9\vsa58c5x.exeC:\ProgramData\EdgeUpdate\mgk8s7d9\vsa58c5x.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\byu2dp2o\ljkx09g3.exeC:\ProgramData\EdgeUpdate\byu2dp2o\ljkx09g3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\ze7i1evk\xqvdg8ki.exeC:\ProgramData\EdgeUpdate\ze7i1evk\xqvdg8ki.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\7o37oh0v\moe8w89w.exeC:\ProgramData\EdgeUpdate\7o37oh0v\moe8w89w.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\k41v61ms\qs1p48rv.exeC:\ProgramData\EdgeUpdate\k41v61ms\qs1p48rv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\wbhorbsf\whbmwasj.exeC:\ProgramData\EdgeUpdate\wbhorbsf\whbmwasj.exe1⤵
-
C:\ProgramData\EdgeUpdate\vlbjbdfw\76kvrfcj.exeC:\ProgramData\EdgeUpdate\vlbjbdfw\76kvrfcj.exe1⤵
-
C:\ProgramData\EdgeUpdate\e06fureb\y4mv5bxh.exeC:\ProgramData\EdgeUpdate\e06fureb\y4mv5bxh.exe1⤵
-
C:\ProgramData\EdgeUpdate\trnsc7ll\0iv9mua8.exeC:\ProgramData\EdgeUpdate\trnsc7ll\0iv9mua8.exe1⤵
-
C:\ProgramData\EdgeUpdate\nablkl98\gzorvxh8.exeC:\ProgramData\EdgeUpdate\nablkl98\gzorvxh8.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
banhi3sa.exe
config.log
webview_support.dll
kernelquick.sys
000011C00E5905B3.exe
memory/3508-1-0x0000021B3A940000-0x0000021B3A990000-memory.dmp
memory/3508-2-0x0000021B3A990000-0x0000021B3A9E7000-memory.dmp
memory/3508-3-0x0000021B3A990000-0x0000021B3A9E7000-memory.dmp
memory/3508-4-0x0000021B3A990000-0x0000021B3A9E7000-memory.dmp
memory/3508-6-0x0000021B3A990000-0x0000021B3A9E7000-memory.dmp
memory/3508-8-0x0000021B3A990000-0x0000021B3A9E7000-memory.dmp
memory/3508-11-0x0000000180000000-0x00000001800EE000-memory.dmp
memory/5340-140-0x0000000007EC0000-0x0000000007F17000-memory.dmp
memory/5340-194-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/5340-37-0x0000000005AE0000-0x0000000005B37000-memory.dmp
memory/5340-38-0x0000000005AE0000-0x0000000005B37000-memory.dmp
memory/5340-35-0x0000000005AE0000-0x0000000005B37000-memory.dmp
memory/5340-42-0x0000000005AE0000-0x0000000005B37000-memory.dmp
memory/5340-59-0x0000000000840000-0x0000000000841000-memory.dmp
memory/5340-69-0x0000000005FC0000-0x0000000006017000-memory.dmp
memory/5340-70-0x0000000005FC0000-0x0000000006017000-memory.dmp
memory/5340-72-0x0000000005FC0000-0x0000000006017000-memory.dmp
memory/5340-74-0x0000000005FC0000-0x0000000006017000-memory.dmp
memory/5340-76-0x0000000005FC0000-0x0000000006017000-memory.dmp
memory/5340-95-0x0000000000860000-0x0000000000861000-memory.dmp
memory/5340-103-0x00000000067F0000-0x0000000006847000-memory.dmp
memory/5340-105-0x00000000067F0000-0x0000000006847000-memory.dmp
memory/5340-107-0x00000000067F0000-0x0000000006847000-memory.dmp
memory/5340-109-0x00000000067F0000-0x0000000006847000-memory.dmp
memory/5340-125-0x0000000000870000-0x0000000000871000-memory.dmp
memory/5340-135-0x0000000007EC0000-0x0000000007F17000-memory.dmp
memory/5340-139-0x0000000007EC0000-0x0000000007F17000-memory.dmp
memory/5340-34-0x0000000005AE0000-0x0000000005B37000-memory.dmp
memory/5340-144-0x0000000007EC0000-0x0000000007F17000-memory.dmp
memory/5340-160-0x00000000030A0000-0x00000000030A1000-memory.dmp
memory/5340-171-0x0000000009B00000-0x0000000009B57000-memory.dmp
memory/5340-173-0x0000000009B00000-0x0000000009B57000-memory.dmp
memory/5340-174-0x0000000009B00000-0x0000000009B57000-memory.dmp
memory/5340-178-0x0000000009B00000-0x0000000009B57000-memory.dmp
memory/5340-36-0x0000000000830000-0x0000000000831000-memory.dmp
memory/5340-202-0x000000000A040000-0x000000000A097000-memory.dmp
memory/5340-206-0x000000000A040000-0x000000000A097000-memory.dmp
memory/5340-209-0x000000000A040000-0x000000000A097000-memory.dmp
memory/5340-214-0x000000000A040000-0x000000000A097000-memory.dmp
memory/5340-230-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/5340-240-0x000000000E710000-0x000000000E767000-memory.dmp
memory/5340-243-0x000000000E710000-0x000000000E767000-memory.dmp
memory/5340-245-0x000000000E710000-0x000000000E767000-memory.dmp
memory/5340-248-0x000000000E710000-0x000000000E767000-memory.dmp
memory/5340-264-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/5340-274-0x000000000F030000-0x000000000F087000-memory.dmp
memory/5340-277-0x000000000F030000-0x000000000F087000-memory.dmp
memory/5340-278-0x000000000F030000-0x000000000F087000-memory.dmp
memory/5340-284-0x000000000F030000-0x000000000F087000-memory.dmp
memory/5340-300-0x0000000005BD0000-0x0000000005BD1000-memory.dmp
memory/5340-312-0x0000000010D50000-0x0000000010DA7000-memory.dmp
memory/5340-314-0x0000000010D50000-0x0000000010DA7000-memory.dmp
memory/5340-315-0x0000000010D50000-0x0000000010DA7000-memory.dmp
memory/5340-319-0x0000000010D50000-0x0000000010DA7000-memory.dmp
memory/5340-336-0x0000000005E90000-0x0000000005E91000-memory.dmp
memory/5340-347-0x0000000012540000-0x0000000012597000-memory.dmp
memory/5340-349-0x0000000012540000-0x0000000012597000-memory.dmp
memory/5340-350-0x0000000012540000-0x0000000012597000-memory.dmp
memory/5340-355-0x0000000012540000-0x0000000012597000-memory.dmp
memory/5340-371-0x00000000061F0000-0x00000000061F1000-memory.dmp
memory/5340-380-0x0000000012880000-0x00000000128D7000-memory.dmp
memory/5340-386-0x0000000012880000-0x00000000128D7000-memory.dmp