valleyrat_s2 | 948e500e26f5be7d2fae6ac14ccaf6fbdc56217db0fb25b9983a5439ba8eb883

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5a8db0cbdee2c9354e590301a684e5c3_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 694KB
Sample260718-ea23hsaw5w
SHA256 948e500e26f5be7d2fae6ac14ccaf6fbdc56217db0fb25b9983a5439ba8eb883
MD5 5a8db0cbdee2c9354e590301a684e5c3
SHA1 b372da740b5aada9d7a08ee8c68527d1e959447a
SHA512 b2a10b4416cdba6c3930d138f70bbe3d9af296b2f6d27d82fe0a4f149f52ff50ba922e576ef20d7bcdeee8606313377ebaa6e635b05290b31ce136d4e7b01004
SSDEEP 12288:CciZ4qN4ZkKdcLtmUzG8GIJ9Eprp63PeE7drlPsgOuvb5iq:525kkKdcLt08/9urp2eE7drZlOuT5iq
TLSH
T1D9E4AF19D7E405F8E1B3E578CE834912EB777C494771D68F03ACA9A61F232909E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

103.112.99.160:1666
103.112.99.160:1888
127.0.0.1:80

Attributes

campaign_date
2026. 7.14

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 8 IoCs

resource	yara_rule
behavioral2/memory/4464-39-0x0000000002BF0000-0x0000000002C28000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2636-40-0x0000000002C10000-0x0000000002C48000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4464-41-0x0000000002BF0000-0x0000000002C28000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2636-42-0x0000000002C10000-0x0000000002C48000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4464-44-0x0000000002BF0000-0x0000000002C28000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4464-43-0x0000000002BF0000-0x0000000002C28000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2636-46-0x0000000002C10000-0x0000000002C48000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2636-45-0x0000000002C10000-0x0000000002C48000-memory.dmp	family_valleyrat_stage_2_v2

Executes dropped EXE 3 IoCs

pid	Process
3100	1.exe
2636	123.exe
4464	123.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\123.exe = "C:\\Users\\Admin\\AppData\\Local\\ProgramDate\\123.exe"	1.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	123.exe
File opened (read-only)	\??\B:	123.exe
File opened (read-only)	\??\Q:	123.exe
File opened (read-only)	\??\T:	123.exe
File opened (read-only)	\??\W:	123.exe
File opened (read-only)	\??\I:	123.exe
File opened (read-only)	\??\M:	123.exe
File opened (read-only)	\??\T:	123.exe
File opened (read-only)	\??\W:	123.exe
File opened (read-only)	\??\I:	123.exe
File opened (read-only)	\??\M:	123.exe
File opened (read-only)	\??\P:	123.exe
File opened (read-only)	\??\R:	123.exe
File opened (read-only)	\??\U:	123.exe
File opened (read-only)	\??\B:	123.exe
File opened (read-only)	\??\K:	123.exe
File opened (read-only)	\??\R:	123.exe
File opened (read-only)	\??\U:	123.exe
File opened (read-only)	\??\L:	123.exe
File opened (read-only)	\??\S:	123.exe
File opened (read-only)	\??\V:	123.exe
File opened (read-only)	\??\G:	123.exe
File opened (read-only)	\??\H:	123.exe
File opened (read-only)	\??\K:	123.exe
File opened (read-only)	\??\O:	123.exe
File opened (read-only)	\??\Y:	123.exe
File opened (read-only)	\??\J:	123.exe
File opened (read-only)	\??\O:	123.exe
File opened (read-only)	\??\Y:	123.exe
File opened (read-only)	\??\Z:	123.exe
File opened (read-only)	\??\N:	123.exe
File opened (read-only)	\??\X:	123.exe
File opened (read-only)	\??\D:	123.exe
File opened (read-only)	\??\H:	123.exe
File opened (read-only)	\??\Q:	123.exe
File opened (read-only)	\??\X:	123.exe
File opened (read-only)	\??\L:	123.exe
File opened (read-only)	\??\Z:	123.exe
File opened (read-only)	\??\D:	123.exe
File opened (read-only)	\??\J:	123.exe
File opened (read-only)	\??\S:	123.exe
File opened (read-only)	\??\V:	123.exe
File opened (read-only)	\??\G:	123.exe
File opened (read-only)	\??\N:	123.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe
4464	123.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4464	123.exe
2636	123.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3100	1032	2026-07-17_5a8db0cbdee2c9354e590301a684e5c3_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 3100 wrote to memory of 2636	3100	1.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a8db0cbdee2c9354e590301a684e5c3_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a8db0cbdee2c9354e590301a684e5c3_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Users\Admin\AppData\Local\ProgramDate\123.exe
    "C:\Users\Admin\AppData\Local\ProgramDate\123.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2636

C:\Users\Admin\AppData\Local\ProgramDate\123.exe
C:\Users\Admin\AppData\Local\ProgramDate\123.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe

Path C:\Users\Admin\AppData\Local\Temp\1.exe
Size 140KB
SHA256 e062c2503925fa40423d52dbad96bc5c8710d121e31b1032f0131f43df9b3866
MD5 38cb77c39d79a5cf7bd7464bd2c89c9a
SHA1 469b441d7f43a810d4cbd7583b2533b6cf5de021
SHA512 b5265c47d9077aa870dd6c255f4a1c4e3a6e1e8bffbedfb5aca6f8471cb38d96226d8ac1b3e61b4b2eb803096c1f75da1eaee127e5777f81b03782003a97779c
SSDEEP 3072:/q/aa4kLKJ7D3ITPF6jVe0vXZulFqtb1gS:/oikLKJnIrcjBjTZ
TLSH
T1DBE34C1BB6A531FAE16BD934C5420905EB72BC764BA1ABDF07904EE70E236D08E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

123.exe

Path C:\Users\Admin\AppData\Local\Temp\date\123.exe
Size 90KB
SHA256 7efe66b9aeb77639cee2e4173f2f25c406eeb7aa1e8a0d32d4a51fc2b127c66d
MD5 b4be5af2183f327eec2968bc47db739f
SHA1 fdc9dc5d4f2e0908a32c3d837beea9e1faebf1cc
SHA512 1b1920e706b7344162d75002621b260f3bb6463e2cf636bcb04d4ea6398f35cfcf02339612da79a3a6b75e5150e755bc2fe513cc3d75ee4b5356897f78d23688
SSDEEP 1536:yZcsJ9kAt6MNb2GvotDAWwW+ecouuNmFtoYNVv2o1NhBL1gzWpsWuLWiccdRoKwJ:yRntcwoTwW+eoemFt/NVv2ShBL1y5Rod
TLSH
T153936C01B5D1C471E97719760CB48AB58B3EF9200F619EEB3388157E4F346C1AA36DBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\date\msvcp140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2636-40-0x0000000002C10000-0x0000000002C48000-memory.dmp

Download

memory/2636-19-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-22-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-24-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-23-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-21-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-20-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-33-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-31-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-50-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/2636-45-0x0000000002C10000-0x0000000002C48000-memory.dmp

Download

memory/2636-46-0x0000000002C10000-0x0000000002C48000-memory.dmp

Download

memory/2636-42-0x0000000002C10000-0x0000000002C48000-memory.dmp

Download

memory/2636-16-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/2636-18-0x00000000008D0000-0x0000000000951000-memory.dmp

Download

memory/2636-38-0x0000000000960000-0x000000000098D000-memory.dmp

Download

memory/4464-28-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-36-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-37-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-39-0x0000000002BF0000-0x0000000002C28000-memory.dmp

Download

memory/4464-41-0x0000000002BF0000-0x0000000002C28000-memory.dmp

Download

memory/4464-26-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-34-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-27-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-44-0x0000000002BF0000-0x0000000002C28000-memory.dmp

Download

memory/4464-43-0x0000000002BF0000-0x0000000002C28000-memory.dmp

Download

memory/4464-25-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-29-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-48-0x00000000006E0000-0x000000000070D000-memory.dmp

Download

memory/4464-30-0x00000000006E0000-0x000000000070D000-memory.dmp

Download