Analysis
- max time kernel
91s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 09:41
General
- Target Install_u7b7.exe
- Size 348KB
- Sample260720-ln16psf14y
- SHA256 c3d09daa83fa0a9c2033d4e88240e3ee470e0b5e7480fa417111e39de036d69f
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.75.103.130:5252
-
47.75.103.130:80
-
campaign_date
2026. 7.16
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 10 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 6 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 58 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Windows security bypass
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Install_u7b7.exe"C:\Users\Admin\AppData\Local\Temp\Install_u7b7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\000007180E59548F.exe"C:\Users\Admin\AppData\Local\Temp\000007180E59548F.exe" --child "C:\Users\Admin\AppData\Local\Temp\Install_u7b7.exe"3⤵
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\EdgeUpdate\9jrk5k3r\htphnpc2.exeC:\ProgramData\EdgeUpdate\9jrk5k3r\htphnpc2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\70flbvgn\j08jrey0.exeC:\ProgramData\EdgeUpdate\70flbvgn\j08jrey0.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\o93evafa\svxx9ztj.exeC:\ProgramData\EdgeUpdate\o93evafa\svxx9ztj.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\29v3dh3c\4lt36prq.exeC:\ProgramData\EdgeUpdate\29v3dh3c\4lt36prq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\iqa544c0\o0cf1rb4.exeC:\ProgramData\EdgeUpdate\iqa544c0\o0cf1rb4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\djtmjykb\wwf0uyin.exeC:\ProgramData\EdgeUpdate\djtmjykb\wwf0uyin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\ecvcma8b\saab9kjf.exeC:\ProgramData\EdgeUpdate\ecvcma8b\saab9kjf.exe1⤵
-
C:\ProgramData\EdgeUpdate\44c1ysvh\dwnygp7u.exeC:\ProgramData\EdgeUpdate\44c1ysvh\dwnygp7u.exe1⤵
-
C:\ProgramData\EdgeUpdate\mw6qao8l\5vmunck0.exeC:\ProgramData\EdgeUpdate\mw6qao8l\5vmunck0.exe1⤵
-
C:\ProgramData\EdgeUpdate\gtdjlrqx\mf9m01cd.exeC:\ProgramData\EdgeUpdate\gtdjlrqx\mf9m01cd.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
htphnpc2.exe
webview_support.dll
kernelquick.sys
000007180E59548F.exe
memory/1120-1-0x00000241C5EF0000-0x00000241C5F40000-memory.dmp
memory/1120-3-0x00000241C5F40000-0x00000241C5F97000-memory.dmp
memory/1120-2-0x00000241C5F40000-0x00000241C5F97000-memory.dmp
memory/1120-4-0x00000241C5F40000-0x00000241C5F97000-memory.dmp
memory/1120-5-0x00000241C5F40000-0x00000241C5F97000-memory.dmp
memory/1120-8-0x00000241C5F40000-0x00000241C5F97000-memory.dmp
memory/1120-10-0x0000000180000000-0x00000001800EE000-memory.dmp
memory/3088-138-0x0000000009700000-0x0000000009757000-memory.dmp
memory/3088-177-0x000000000A220000-0x000000000A277000-memory.dmp
memory/3088-35-0x00000000067A0000-0x00000000067F7000-memory.dmp
memory/3088-36-0x00000000067A0000-0x00000000067F7000-memory.dmp
memory/3088-34-0x00000000067A0000-0x00000000067F7000-memory.dmp
memory/3088-42-0x00000000067A0000-0x00000000067F7000-memory.dmp
memory/3088-58-0x00000000039A0000-0x00000000039A1000-memory.dmp
memory/3088-69-0x0000000006B40000-0x0000000006B97000-memory.dmp
memory/3088-71-0x0000000006B40000-0x0000000006B97000-memory.dmp
memory/3088-72-0x0000000006B40000-0x0000000006B97000-memory.dmp
memory/3088-75-0x0000000006B40000-0x0000000006B97000-memory.dmp
memory/3088-92-0x00000000039B0000-0x00000000039B1000-memory.dmp
memory/3088-102-0x0000000007040000-0x0000000007097000-memory.dmp
memory/3088-104-0x0000000007040000-0x0000000007097000-memory.dmp
memory/3088-105-0x0000000007040000-0x0000000007097000-memory.dmp
memory/3088-108-0x0000000007040000-0x0000000007097000-memory.dmp
memory/3088-124-0x0000000003C20000-0x0000000003C21000-memory.dmp
memory/3088-136-0x0000000009700000-0x0000000009757000-memory.dmp
memory/3088-32-0x00000000067A0000-0x00000000067F7000-memory.dmp
memory/3088-139-0x0000000009700000-0x0000000009757000-memory.dmp
memory/3088-143-0x0000000009700000-0x0000000009757000-memory.dmp
memory/3088-159-0x0000000003F50000-0x0000000003F51000-memory.dmp
memory/3088-170-0x000000000A220000-0x000000000A277000-memory.dmp
memory/3088-172-0x000000000A220000-0x000000000A277000-memory.dmp
memory/3088-173-0x000000000A220000-0x000000000A277000-memory.dmp
memory/3088-33-0x0000000003CB0000-0x0000000003CB1000-memory.dmp
memory/3088-193-0x0000000006900000-0x0000000006901000-memory.dmp
memory/3088-205-0x000000000EC70000-0x000000000ECC7000-memory.dmp
memory/3088-207-0x000000000EC70000-0x000000000ECC7000-memory.dmp
memory/3088-208-0x000000000EC70000-0x000000000ECC7000-memory.dmp
memory/3088-213-0x000000000EC70000-0x000000000ECC7000-memory.dmp
memory/3088-229-0x00000000042E0000-0x00000000042E1000-memory.dmp
memory/3088-240-0x000000000FB90000-0x000000000FBE7000-memory.dmp
memory/3088-242-0x000000000FB90000-0x000000000FBE7000-memory.dmp
memory/3088-244-0x000000000FB90000-0x000000000FBE7000-memory.dmp
memory/3088-247-0x000000000FB90000-0x000000000FBE7000-memory.dmp
memory/3088-264-0x0000000006D50000-0x0000000006D51000-memory.dmp
memory/3088-272-0x0000000010150000-0x00000000101A7000-memory.dmp
memory/3088-276-0x0000000010150000-0x00000000101A7000-memory.dmp
memory/3088-277-0x0000000010150000-0x00000000101A7000-memory.dmp
memory/3088-284-0x0000000010150000-0x00000000101A7000-memory.dmp
memory/3088-301-0x00000000070B0000-0x00000000070B1000-memory.dmp
memory/3088-311-0x00000000126F0000-0x0000000012747000-memory.dmp
memory/3088-313-0x00000000126F0000-0x0000000012747000-memory.dmp
memory/3088-314-0x00000000126F0000-0x0000000012747000-memory.dmp
memory/3088-321-0x00000000126F0000-0x0000000012747000-memory.dmp
memory/3088-337-0x0000000006920000-0x0000000006921000-memory.dmp
memory/3088-345-0x0000000012FC0000-0x0000000013017000-memory.dmp
memory/3088-349-0x0000000012FC0000-0x0000000013017000-memory.dmp
memory/3088-350-0x0000000012FC0000-0x0000000013017000-memory.dmp