Analysis
- max time kernel
100s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 11:06
General
- Target 4ecef92a636e26d33d495b113f6bc7b23b3e03bfb34b9f79ea7837ce3072f8c1.exe
- Size 348KB
- Sample260720-m7grvafy2j
- SHA256 4ecef92a636e26d33d495b113f6bc7b23b3e03bfb34b9f79ea7837ce3072f8c1
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.75.103.130:5252
-
47.75.103.130:80
-
campaign_date
2026. 7.16
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 10 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 6 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 60 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ecef92a636e26d33d495b113f6bc7b23b3e03bfb34b9f79ea7837ce3072f8c1.exe"C:\Users\Admin\AppData\Local\Temp\4ecef92a636e26d33d495b113f6bc7b23b3e03bfb34b9f79ea7837ce3072f8c1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\000004D80E58DA2E.exe"C:\Users\Admin\AppData\Local\Temp\000004D80E58DA2E.exe" --child "C:\Users\Admin\AppData\Local\Temp\4ecef92a636e26d33d495b113f6bc7b23b3e03bfb34b9f79ea7837ce3072f8c1.exe"3⤵
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\EdgeUpdate\rb9mv77e\cv1746gl.exeC:\ProgramData\EdgeUpdate\rb9mv77e\cv1746gl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\83c251hj\lf2bvkex.exeC:\ProgramData\EdgeUpdate\83c251hj\lf2bvkex.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\bnixgjap\ka2p2w2m.exeC:\ProgramData\EdgeUpdate\bnixgjap\ka2p2w2m.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\md3y61xj\us832a8c.exeC:\ProgramData\EdgeUpdate\md3y61xj\us832a8c.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\nle10uby\52o6syd7.exeC:\ProgramData\EdgeUpdate\nle10uby\52o6syd7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\xxg9drti\9t2v2l8u.exeC:\ProgramData\EdgeUpdate\xxg9drti\9t2v2l8u.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\EdgeUpdate\ab6k8zgj\7solbg51.exeC:\ProgramData\EdgeUpdate\ab6k8zgj\7solbg51.exe1⤵
-
C:\ProgramData\EdgeUpdate\9o20xxfo\5nufk4xf.exeC:\ProgramData\EdgeUpdate\9o20xxfo\5nufk4xf.exe1⤵
-
C:\ProgramData\EdgeUpdate\5mooq7zk\3eeuauga.exeC:\ProgramData\EdgeUpdate\5mooq7zk\3eeuauga.exe1⤵
-
C:\ProgramData\EdgeUpdate\if59noum\yqcx9xbk.exeC:\ProgramData\EdgeUpdate\if59noum\yqcx9xbk.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
cv1746gl.exe
webview_support.dll
kernelquick.sys
000004D80E58DA2E.exe
memory/700-1-0x00000241C0840000-0x00000241C0890000-memory.dmp
memory/700-2-0x00000241C0C10000-0x00000241C0C67000-memory.dmp
memory/700-3-0x00000241C0C10000-0x00000241C0C67000-memory.dmp
memory/700-4-0x00000241C0C10000-0x00000241C0C67000-memory.dmp
memory/700-6-0x00000241C0C10000-0x00000241C0C67000-memory.dmp
memory/700-8-0x00000241C0C10000-0x00000241C0C67000-memory.dmp
memory/700-10-0x0000000180000000-0x00000001800EE000-memory.dmp
memory/5616-137-0x0000000007ED0000-0x0000000007F27000-memory.dmp
memory/5616-171-0x0000000009B80000-0x0000000009BD7000-memory.dmp
memory/5616-37-0x0000000005800000-0x0000000005857000-memory.dmp
memory/5616-39-0x0000000005800000-0x0000000005857000-memory.dmp
memory/5616-35-0x0000000005800000-0x0000000005857000-memory.dmp
memory/5616-42-0x0000000005800000-0x0000000005857000-memory.dmp
memory/5616-59-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/5616-69-0x0000000005CC0000-0x0000000005D17000-memory.dmp
memory/5616-70-0x0000000005CC0000-0x0000000005D17000-memory.dmp
memory/5616-72-0x0000000005CC0000-0x0000000005D17000-memory.dmp
memory/5616-73-0x0000000005CC0000-0x0000000005D17000-memory.dmp
memory/5616-76-0x0000000005CC0000-0x0000000005D17000-memory.dmp
memory/5616-95-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/5616-103-0x0000000007010000-0x0000000007067000-memory.dmp
memory/5616-105-0x0000000007010000-0x0000000007067000-memory.dmp
memory/5616-106-0x0000000007010000-0x0000000007067000-memory.dmp
memory/5616-109-0x0000000007010000-0x0000000007067000-memory.dmp
memory/5616-127-0x0000000003030000-0x0000000003031000-memory.dmp
memory/5616-34-0x0000000005800000-0x0000000005857000-memory.dmp
memory/5616-139-0x0000000007ED0000-0x0000000007F27000-memory.dmp
memory/5616-140-0x0000000007ED0000-0x0000000007F27000-memory.dmp
memory/5616-145-0x0000000007ED0000-0x0000000007F27000-memory.dmp
memory/5616-161-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/5616-36-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/5616-173-0x0000000009B80000-0x0000000009BD7000-memory.dmp
memory/5616-174-0x0000000009B80000-0x0000000009BD7000-memory.dmp
memory/5616-180-0x0000000009B80000-0x0000000009BD7000-memory.dmp
memory/5616-198-0x0000000005700000-0x0000000005701000-memory.dmp
memory/5616-208-0x000000000E210000-0x000000000E267000-memory.dmp
memory/5616-210-0x000000000E210000-0x000000000E267000-memory.dmp
memory/5616-211-0x000000000E210000-0x000000000E267000-memory.dmp
memory/5616-216-0x000000000E210000-0x000000000E267000-memory.dmp
memory/5616-232-0x0000000003180000-0x0000000003181000-memory.dmp
memory/5616-241-0x000000000E910000-0x000000000E967000-memory.dmp
memory/5616-245-0x000000000E910000-0x000000000E967000-memory.dmp
memory/5616-246-0x000000000E910000-0x000000000E967000-memory.dmp
memory/5616-254-0x000000000E910000-0x000000000E967000-memory.dmp
memory/5616-270-0x0000000003040000-0x0000000003041000-memory.dmp
memory/5616-280-0x000000000E810000-0x000000000E867000-memory.dmp
memory/5616-282-0x000000000E810000-0x000000000E867000-memory.dmp
memory/5616-284-0x000000000E810000-0x000000000E867000-memory.dmp
memory/5616-288-0x000000000E810000-0x000000000E867000-memory.dmp
memory/5616-304-0x0000000003170000-0x0000000003171000-memory.dmp
memory/5616-314-0x000000000F360000-0x000000000F3B7000-memory.dmp
memory/5616-316-0x000000000F360000-0x000000000F3B7000-memory.dmp
memory/5616-317-0x000000000F360000-0x000000000F3B7000-memory.dmp
memory/5616-322-0x000000000F360000-0x000000000F3B7000-memory.dmp
memory/5616-338-0x00000000037A0000-0x00000000037A1000-memory.dmp