Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6.exe
- Size 348KB
- Sample260721-ntp2qset6n
- SHA256 9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6
- MD5 ae108871833924e7b586aa1fdf786af0
- SHA1 cc0bc8a75b7b896b2671dc789fe54c24de94b922
- SHA512 1e8c09cf117c9a2941b935b451eda93da58cdd6c232eca951cac3ea94d7e0fcec54bee76b2569ea196d46c41045eeb1c36097e983519b28167ccb1a663604abd
- SSDEEP 6144:nh3JLdfjMGT/Tg7BfX19H3T+T7FKgNEcsB5EEeluEOwhaTehawRI:h3JBBTT/hETB5ECEyRL
- TLSH T17974EFDC6F72F576EB02EF37000D998697E461540DBB0CA3B7E850A847F22A7D95E182
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.75.103.130:5252
-
47.75.103.130:80
Attributes
-
campaign_date
2026. 7.16
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 1 IoCs
resource yara_rule behavioral2/memory/3356-8-0x000001F9035B0000-0x000001F903607000-memory.dmp family_valleyrat_stage_2_v2 - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 000004480E595DB6.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 000004480E595DB6.exe - Deletes itself 1 IoCs
pid Process 3356 000004480E595DB6.exe - Executes dropped EXE 1 IoCs
pid Process 3356 000004480E595DB6.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 000004480E595DB6.exe File opened (read-only) \??\W: 000004480E595DB6.exe File opened (read-only) \??\X: 000004480E595DB6.exe File opened (read-only) \??\Y: 000004480E595DB6.exe File opened (read-only) \??\D: 000004480E595DB6.exe File opened (read-only) \??\H: 000004480E595DB6.exe File opened (read-only) \??\M: 000004480E595DB6.exe File opened (read-only) \??\S: 000004480E595DB6.exe File opened (read-only) \??\V: 000004480E595DB6.exe File opened (read-only) \??\Z: 000004480E595DB6.exe File opened (read-only) \??\U: 000004480E595DB6.exe File opened (read-only) \??\B: 000004480E595DB6.exe File opened (read-only) \??\G: 000004480E595DB6.exe File opened (read-only) \??\I: 000004480E595DB6.exe File opened (read-only) \??\J: 000004480E595DB6.exe File opened (read-only) \??\K: 000004480E595DB6.exe File opened (read-only) \??\O: 000004480E595DB6.exe File opened (read-only) \??\R: 000004480E595DB6.exe File opened (read-only) \??\T: 000004480E595DB6.exe File opened (read-only) \??\L: 000004480E595DB6.exe File opened (read-only) \??\N: 000004480E595DB6.exe File opened (read-only) \??\P: 000004480E595DB6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe 3356 000004480E595DB6.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3356 000004480E595DB6.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1096 wrote to memory of 3356 1096 9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6.exe 89 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6.exe"C:\Users\Admin\AppData\Local\Temp\9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\000004480E595DB6.exe"C:\Users\Admin\AppData\Local\Temp\000004480E595DB6.exe" --child "C:\Users\Admin\AppData\Local\Temp\9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3356
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\000004480E595DB6.exe
- Size 348KB
- SHA256 9230b8efca853df461d60831af04976ad880e5c1decd671b5263eefe34857cc6
- MD5 ae108871833924e7b586aa1fdf786af0
- SHA1 cc0bc8a75b7b896b2671dc789fe54c24de94b922
- SHA512 1e8c09cf117c9a2941b935b451eda93da58cdd6c232eca951cac3ea94d7e0fcec54bee76b2569ea196d46c41045eeb1c36097e983519b28167ccb1a663604abd
- SSDEEP 6144:nh3JLdfjMGT/Tg7BfX19H3T+T7FKgNEcsB5EEeluEOwhaTehawRI:h3JBBTT/hETB5ECEyRL
- TLSH T17974EFDC6F72F576EB02EF37000D998697E461540DBB0CA3B7E850A847F22A7D95E182
- MD5 SHA1 SHA512 SSDEEP TLSH