Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_098k.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_098k.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target Install_098k.exe
- Size 343KB
- Sample260724-ldq8rawhpg
- SHA256 8c8925ce1d14d062830db9213a4629a4de53d463bba43be7f5c3ee7925796bad
- MD5 6de10b524a1e89103a5359fb164328a7
- SHA1 36535f877e25cebd3762b91c912f263ce4a1d51e
- SHA512 d953b0532f108ba9cbece212286cec73d5a208e9e6c16962e287eaa9807c852ac5e8b8730f42952fb1b86ba51dee94900c81ec6ab0800df8aae8ee37d34d9410
- SSDEEP 6144:cxhJB6DmJ1ObQg7ADDj2hmwqzOPI4zEu0zwKrQJlBtuQjN9WZUApCcisR:OJB6ammlQPzEu4RytusN/ER
- TLSH T1F274F0DCD4180954CC4CE9307F8758F1926F85F85AB0C6963DA9B5CF7AEAAE726C0231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.243.36.18:5252
-
47.243.36.18:80
Attributes
-
campaign_date
2026. 7.21
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 2 IoCs
resource yara_rule behavioral2/memory/4852-7-0x00000224CF540000-0x00000224CF596000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4852-19-0x00000224CF540000-0x00000224CF596000-memory.dmp family_valleyrat_stage_2_v2 - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 00000C700E58FE70.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 4288 powershell.exe 4288 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\k32.sys 00000C700E58FE70.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 00000C700E58FE70.exe - Deletes itself 1 IoCs
pid Process 4852 00000C700E58FE70.exe - Executes dropped EXE 2 IoCs
pid Process 4852 00000C700E58FE70.exe 5076 k32.sys - Loads dropped DLL 1 IoCs
pid Process 4852 00000C700E58FE70.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 00000C700E58FE70.exe File opened (read-only) \??\S: 00000C700E58FE70.exe File opened (read-only) \??\T: 00000C700E58FE70.exe File opened (read-only) \??\V: 00000C700E58FE70.exe File opened (read-only) \??\D: 00000C700E58FE70.exe File opened (read-only) \??\J: 00000C700E58FE70.exe File opened (read-only) \??\U: 00000C700E58FE70.exe File opened (read-only) \??\W: 00000C700E58FE70.exe File opened (read-only) \??\Z: 00000C700E58FE70.exe File opened (read-only) \??\B: 00000C700E58FE70.exe File opened (read-only) \??\G: 00000C700E58FE70.exe File opened (read-only) \??\L: 00000C700E58FE70.exe File opened (read-only) \??\M: 00000C700E58FE70.exe File opened (read-only) \??\R: 00000C700E58FE70.exe File opened (read-only) \??\Y: 00000C700E58FE70.exe File opened (read-only) \??\I: 00000C700E58FE70.exe File opened (read-only) \??\K: 00000C700E58FE70.exe File opened (read-only) \??\X: 00000C700E58FE70.exe File opened (read-only) \??\H: 00000C700E58FE70.exe File opened (read-only) \??\N: 00000C700E58FE70.exe File opened (read-only) \??\O: 00000C700E58FE70.exe File opened (read-only) \??\P: 00000C700E58FE70.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe 4852 00000C700E58FE70.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe Token: SeDebugPrivilege 4852 00000C700E58FE70.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4852 00000C700E58FE70.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3184 wrote to memory of 4852 3184 Install_098k.exe 89 PID 4852 wrote to memory of 4288 4852 00000C700E58FE70.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install_098k.exe"C:\Users\Admin\AppData\Local\Temp\Install_098k.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\00000C700E58FE70.exe"C:\Users\Admin\AppData\Local\Temp\00000C700E58FE70.exe" --child "C:\Users\Admin\AppData\Local\Temp\Install_098k.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\drivers' -ExclusionProcess 'services.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
PID:4288
-
-
-
C:\Windows\System32\drivers\k32.sysC:\Windows\System32\drivers\k32.sys1⤵
- Executes dropped EXE
PID:5076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\00000C700E58FE70.exe
- Size 343KB
- SHA256 8c8925ce1d14d062830db9213a4629a4de53d463bba43be7f5c3ee7925796bad
- MD5 6de10b524a1e89103a5359fb164328a7
- SHA1 36535f877e25cebd3762b91c912f263ce4a1d51e
- SHA512 d953b0532f108ba9cbece212286cec73d5a208e9e6c16962e287eaa9807c852ac5e8b8730f42952fb1b86ba51dee94900c81ec6ab0800df8aae8ee37d34d9410
- SSDEEP 6144:cxhJB6DmJ1ObQg7ADDj2hmwqzOPI4zEu0zwKrQJlBtuQjN9WZUApCcisR:OJB6ammlQPzEu4RytusN/ER
- TLSH T1F274F0DCD4180954CC4CE9307F8758F1926F85F85AB0C6963DA9B5CF7AEAAE726C0231
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Plg286E.tmp
- Size 449KB
- SHA256 b3a2e3df2eb6ec08460dc7a1bc2967c4270b3fc9b45f474285d894c66f5838cb
- MD5 b9fd8808c3fb69707614df46f45efad3
- SHA1 44be0761c835d4de1dc1b1b0d65e473f2ec6af38
- SHA512 39d12f0df5454a79c3a4f0ea22ea281fea7031a0ec58b83bd4d1ba3e47e152d670115e124738e92652fbf0ec6a74850543427dc066202b07612d1a5420761f01
- SSDEEP 6144:0EZGTochQs0oT27znNNu37DKYymT1c+ybxlQas+kby6hKhalAK4aCdJEDsY:0EZGhhQFRlmT1cNlRP6OTHy
- TLSH T124A48E1AF7A510BAE177C13CC9538916E7B274450760EBDF07608ABA2F237D0AA3D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\k32.sys
- Size 27KB
- SHA256 b8de157d2ccc5208643470c97e319030581121c51e4d48876cc25b8fbd0adb5a
- MD5 8aa6d49fcc9b4c61954237ac997e350d
- SHA1 79c8f50f166830ca89983c07dbe7493484bf3091
- SHA512 d5dec999369e6405de409f1cb582af8f460b03d5bf210b1cd728486d41793fe82c59008dbc87dccfe808626ccda2f4fccb1d27892becee9e3dfd1bd7aa7aafe5
- SSDEEP 768:E8sFaxUymijHpR8Fuw+vpMtsk0xHupdwdn:E8sqLTjHwU+05mdm
- TLSH T17AD22942639124D6FAFBC6B8D6AA591EBBB0F84347018AEF0564C1A50F737C0793DB19
- MD5 SHA1 SHA512 SSDEEP TLSH