Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 11:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_s9ri.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_s9ri.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target Install_s9ri.exe
- Size 347KB
- Sample260727-nfkvvsdn7v
- SHA256 d80115a287c0a398e75b03f55f1d5f6bb69e201458794c10e8310242b38dfd97
- MD5 c569b70144cf9c5870e2d3d374f72aca
- SHA1 5a8c247ee233e2ae433cbbaf57eec7331d12353f
- SHA512 3bcd446f8004d40df3d797c240a054b11ad558fcae09f9cbca9d5389302dbf2fd1f3367742317fa7970f8f545bb0d22d349a235db62343e24929d997c4d04fa5
- SSDEEP 6144:6FmVgbmQ/5mptxFyEKD8zIoVmp/wgSrIu7+/hI1eaEXs/pU1PBPR:UxmQ/q/y7DOIoVmp/YUu7Eawa1WpR
- TLSH T1B374E03512CA3774CE7918785E707E0BB27EE60B2BD88AC64F71593872439E32B1E156
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.242.198.248:5252
-
47.242.198.248:80
Attributes
-
campaign_date
2026. 7.21
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 2 IoCs
resource yara_rule behavioral2/memory/2392-7-0x0000028A83CB0000-0x0000028A83D06000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2392-19-0x0000028A83CB0000-0x0000028A83D06000-memory.dmp family_valleyrat_stage_2_v2 - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 000015A00E599292.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 2528 powershell.exe 2528 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\k32.sys 000015A00E599292.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 000015A00E599292.exe - Deletes itself 1 IoCs
pid Process 2392 000015A00E599292.exe - Executes dropped EXE 2 IoCs
pid Process 2392 000015A00E599292.exe 6056 k32.sys - Loads dropped DLL 1 IoCs
pid Process 2392 000015A00E599292.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 000015A00E599292.exe File opened (read-only) \??\P: 000015A00E599292.exe File opened (read-only) \??\Q: 000015A00E599292.exe File opened (read-only) \??\U: 000015A00E599292.exe File opened (read-only) \??\J: 000015A00E599292.exe File opened (read-only) \??\K: 000015A00E599292.exe File opened (read-only) \??\L: 000015A00E599292.exe File opened (read-only) \??\N: 000015A00E599292.exe File opened (read-only) \??\V: 000015A00E599292.exe File opened (read-only) \??\X: 000015A00E599292.exe File opened (read-only) \??\Z: 000015A00E599292.exe File opened (read-only) \??\O: 000015A00E599292.exe File opened (read-only) \??\R: 000015A00E599292.exe File opened (read-only) \??\S: 000015A00E599292.exe File opened (read-only) \??\T: 000015A00E599292.exe File opened (read-only) \??\W: 000015A00E599292.exe File opened (read-only) \??\B: 000015A00E599292.exe File opened (read-only) \??\D: 000015A00E599292.exe File opened (read-only) \??\G: 000015A00E599292.exe File opened (read-only) \??\H: 000015A00E599292.exe File opened (read-only) \??\I: 000015A00E599292.exe File opened (read-only) \??\Y: 000015A00E599292.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe 2392 000015A00E599292.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe Token: SeDebugPrivilege 2392 000015A00E599292.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2392 000015A00E599292.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5536 wrote to memory of 2392 5536 Install_s9ri.exe 87 PID 2392 wrote to memory of 2528 2392 000015A00E599292.exe 89 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install_s9ri.exe"C:\Users\Admin\AppData\Local\Temp\Install_s9ri.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\000015A00E599292.exe"C:\Users\Admin\AppData\Local\Temp\000015A00E599292.exe" --child "C:\Users\Admin\AppData\Local\Temp\Install_s9ri.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\drivers' -ExclusionProcess 'services.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
PID:2528
-
-
-
C:\Windows\System32\drivers\k32.sysC:\Windows\System32\drivers\k32.sys1⤵
- Executes dropped EXE
PID:6056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\000015A00E599292.exe
- Size 347KB
- SHA256 d80115a287c0a398e75b03f55f1d5f6bb69e201458794c10e8310242b38dfd97
- MD5 c569b70144cf9c5870e2d3d374f72aca
- SHA1 5a8c247ee233e2ae433cbbaf57eec7331d12353f
- SHA512 3bcd446f8004d40df3d797c240a054b11ad558fcae09f9cbca9d5389302dbf2fd1f3367742317fa7970f8f545bb0d22d349a235db62343e24929d997c4d04fa5
- SSDEEP 6144:6FmVgbmQ/5mptxFyEKD8zIoVmp/wgSrIu7+/hI1eaEXs/pU1PBPR:UxmQ/q/y7DOIoVmp/YUu7Eawa1WpR
- TLSH T1B374E03512CA3774CE7918785E707E0BB27EE60B2BD88AC64F71593872439E32B1E156
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PlgBCED.tmp
- Size 449KB
- SHA256 e5832f3521fb4d56026bd59437c1d25c05cb98d998883e23d8bc280ba6ca2445
- MD5 fd75415d48599164223fae96c72109f7
- SHA1 6dafcfbb82d2e4b70c26971873e2be307e1c7f6f
- SHA512 9af68bf07ad08bc62a1c4bf1749141d50fe2750d74b70d2a021d959b50e2bb32aa8d86d72dd5e23d7906aa2c1e6514ae876a123dcf64030c3cf6159a35489444
- SSDEEP 6144:VEZGTochQs0oT27znNNu37DKYymT1c+ybxlQas+kby6hKhalAK4TCdJwDsY:VEZGhhQFRlmT1cNlRP6OTkm
- TLSH T1C2A48E1AF7A510BAE177C13CC9538916E7B274450760EBDF07608ABA2F237D0AA3D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\k32.sys
- Size 27KB
- SHA256 b8de157d2ccc5208643470c97e319030581121c51e4d48876cc25b8fbd0adb5a
- MD5 8aa6d49fcc9b4c61954237ac997e350d
- SHA1 79c8f50f166830ca89983c07dbe7493484bf3091
- SHA512 d5dec999369e6405de409f1cb582af8f460b03d5bf210b1cd728486d41793fe82c59008dbc87dccfe808626ccda2f4fccb1d27892becee9e3dfd1bd7aa7aafe5
- SSDEEP 768:E8sFaxUymijHpR8Fuw+vpMtsk0xHupdwdn:E8sqLTjHwU+05mdm
- TLSH T17AD22942639124D6FAFBC6B8D6AA591EBBB0F84347018AEF0564C1A50F737C0793DB19
- MD5 SHA1 SHA512 SSDEEP TLSH