Analysis
- max time kernel
85s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 16:11
General
- Target sptsi_yo4o.exe
- Size 347KB
- Sample260717-tm7absfs2k
- SHA256 ec3c30c6447713970aaa9e9a244f3f85136225435dc16185b44704e8a516c138
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.243.36.18:5252
-
47.243.36.18:80
-
campaign_date
2026. 7. 7
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 11 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 6 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 56 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Windows security bypass
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sptsi_yo4o.exe"C:\Users\Admin\AppData\Local\Temp\sptsi_yo4o.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\000012180E59547F.exe"C:\Users\Admin\AppData\Local\Temp\000012180E59547F.exe" --child "C:\Users\Admin\AppData\Local\Temp\sptsi_yo4o.exe"3⤵
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\EdgeUpdate\xlom4wgq\j5davfwt.exeC:\ProgramData\EdgeUpdate\xlom4wgq\j5davfwt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\85p0kjsj\a4aiyfd2.exeC:\ProgramData\EdgeUpdate\85p0kjsj\a4aiyfd2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\7159j03p\jebngo72.exeC:\ProgramData\EdgeUpdate\7159j03p\jebngo72.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\skvkouba\4qq56fbj.exeC:\ProgramData\EdgeUpdate\skvkouba\4qq56fbj.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\v78ror8e\mkhlh2qn.exeC:\ProgramData\EdgeUpdate\v78ror8e\mkhlh2qn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\d7kbl2v3\89n6mttq.exeC:\ProgramData\EdgeUpdate\d7kbl2v3\89n6mttq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\qfk944ji\drpnv5ht.exeC:\ProgramData\EdgeUpdate\qfk944ji\drpnv5ht.exe1⤵
-
C:\ProgramData\EdgeUpdate\1g3qq36y\w5kcp2xp.exeC:\ProgramData\EdgeUpdate\1g3qq36y\w5kcp2xp.exe1⤵
-
C:\ProgramData\EdgeUpdate\z46y9s07\8b7g94r8.exeC:\ProgramData\EdgeUpdate\z46y9s07\8b7g94r8.exe1⤵
-
C:\ProgramData\EdgeUpdate\4cgydzm0\8k5dn81p.exeC:\ProgramData\EdgeUpdate\4cgydzm0\8k5dn81p.exe1⤵
-
C:\ProgramData\EdgeUpdate\8cl6y4vh\pagiabbv.exeC:\ProgramData\EdgeUpdate\8cl6y4vh\pagiabbv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
j5davfwt.exe
webview_support.dll
kernelquick.sys
000012180E59547F.exe
memory/1820-196-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/1820-207-0x000000000E5F0000-0x000000000E647000-memory.dmp
memory/1820-384-0x00000000147E0000-0x0000000014837000-memory.dmp
memory/1820-36-0x00000000032F0000-0x00000000032F1000-memory.dmp
memory/1820-37-0x0000000005020000-0x0000000005077000-memory.dmp
memory/1820-38-0x0000000005020000-0x0000000005077000-memory.dmp
memory/1820-34-0x0000000005020000-0x0000000005077000-memory.dmp
memory/1820-42-0x0000000005020000-0x0000000005077000-memory.dmp
memory/1820-61-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/1820-69-0x00000000052D0000-0x0000000005327000-memory.dmp
memory/1820-70-0x00000000052D0000-0x0000000005327000-memory.dmp
memory/1820-72-0x00000000052D0000-0x0000000005327000-memory.dmp
memory/1820-73-0x00000000052D0000-0x0000000005327000-memory.dmp
memory/1820-76-0x00000000052D0000-0x0000000005327000-memory.dmp
memory/1820-93-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/1820-103-0x0000000008CC0000-0x0000000008D17000-memory.dmp
memory/1820-105-0x0000000008CC0000-0x0000000008D17000-memory.dmp
memory/1820-107-0x0000000008CC0000-0x0000000008D17000-memory.dmp
memory/1820-109-0x0000000008CC0000-0x0000000008D17000-memory.dmp
memory/1820-125-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/1820-137-0x0000000009140000-0x0000000009197000-memory.dmp
memory/1820-139-0x0000000009140000-0x0000000009197000-memory.dmp
memory/1820-140-0x0000000009140000-0x0000000009197000-memory.dmp
memory/1820-144-0x0000000009140000-0x0000000009197000-memory.dmp
memory/1820-161-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
memory/1820-171-0x000000000A0D0000-0x000000000A127000-memory.dmp
memory/1820-173-0x000000000A0D0000-0x000000000A127000-memory.dmp
memory/1820-174-0x000000000A0D0000-0x000000000A127000-memory.dmp
memory/1820-177-0x000000000A0D0000-0x000000000A127000-memory.dmp
memory/1820-35-0x0000000005020000-0x0000000005077000-memory.dmp
memory/1820-204-0x000000000E5F0000-0x000000000E647000-memory.dmp
memory/1820-206-0x000000000E5F0000-0x000000000E647000-memory.dmp
memory/1820-383-0x00000000147E0000-0x0000000014837000-memory.dmp
memory/1820-208-0x000000000E5F0000-0x000000000E647000-memory.dmp
memory/1820-213-0x000000000E5F0000-0x000000000E647000-memory.dmp
memory/1820-230-0x0000000003320000-0x0000000003321000-memory.dmp
memory/1820-240-0x000000000ECF0000-0x000000000ED47000-memory.dmp
memory/1820-242-0x000000000ECF0000-0x000000000ED47000-memory.dmp
memory/1820-243-0x000000000ECF0000-0x000000000ED47000-memory.dmp
memory/1820-247-0x000000000ECF0000-0x000000000ED47000-memory.dmp
memory/1820-264-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/1820-274-0x000000000FBB0000-0x000000000FC07000-memory.dmp
memory/1820-276-0x000000000FBB0000-0x000000000FC07000-memory.dmp
memory/1820-278-0x000000000FBB0000-0x000000000FC07000-memory.dmp
memory/1820-277-0x000000000FBB0000-0x000000000FC07000-memory.dmp
memory/1820-281-0x000000000FBB0000-0x000000000FC07000-memory.dmp
memory/1820-298-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/1820-310-0x0000000012240000-0x0000000012297000-memory.dmp
memory/1820-312-0x0000000012240000-0x0000000012297000-memory.dmp
memory/1820-314-0x0000000012240000-0x0000000012297000-memory.dmp
memory/1820-319-0x0000000012240000-0x0000000012297000-memory.dmp
memory/1820-336-0x0000000003650000-0x0000000003651000-memory.dmp
memory/1820-346-0x0000000013A00000-0x0000000013A57000-memory.dmp
memory/1820-348-0x0000000013A00000-0x0000000013A57000-memory.dmp
memory/1820-349-0x0000000013A00000-0x0000000013A57000-memory.dmp
memory/1820-354-0x0000000013A00000-0x0000000013A57000-memory.dmp
memory/1820-371-0x0000000003680000-0x0000000003681000-memory.dmp
memory/1820-381-0x00000000147E0000-0x0000000014837000-memory.dmp
memory/5164-1-0x0000021FD4B70000-0x0000021FD4BC0000-memory.dmp
memory/5164-2-0x0000021FD4BC0000-0x0000021FD4C17000-memory.dmp
memory/5164-3-0x0000021FD4BC0000-0x0000021FD4C17000-memory.dmp
memory/5164-4-0x0000021FD4BC0000-0x0000021FD4C17000-memory.dmp
memory/5164-5-0x0000021FD4BC0000-0x0000021FD4C17000-memory.dmp
memory/5164-8-0x0000021FD4BC0000-0x0000021FD4C17000-memory.dmp
memory/5164-11-0x0000000180000000-0x00000001800EE000-memory.dmp