Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_s9ri.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_s9ri.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target Install_s9ri.exe
- Size 347KB
- Sample260727-src2lswthx
- SHA256 e93bfa7cc056600ca5f72727fc6c35f74318c0fe41d989af432efb179a03dd3e
- MD5 b240ef26296ec74d886e08e05065133f
- SHA1 a7daa2090344803aecdd31d641c34e8168baa807
- SHA512 0d0ab0db42fbf7c18b0c631cd81f372f8f39f5691299f0498e2dfe4dbc2edb7cd5235977afa327cce0dd28f16b2c1b78dea5ca52fab740ca430ec685b5304d8d
- SSDEEP 6144:6FmVgbmQ/5mptxFyEKD8zIoVmp/wgSrIu7+/hI1eaEXs/pU1PBPD:UxmQ/q/y7DOIoVmp/YUu7Eawa1WpD
- TLSH T18874E03512CA3774CE7918785E707E0BB27EE60B17D88AC64F7159387243AE32B1E156
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.242.198.248:5252
-
47.242.198.248:80
Attributes
-
campaign_date
2026. 7.21
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 2 IoCs
resource yara_rule behavioral2/memory/4204-7-0x000001B6EDA80000-0x000001B6EDAD6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4204-19-0x000001B6EDA80000-0x000001B6EDAD6000-memory.dmp family_valleyrat_stage_2_v2 - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 00000F200E592A33.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 4244 powershell.exe 4244 powershell.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\k32.sys 00000F200E592A33.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 00000F200E592A33.exe - Deletes itself 1 IoCs
pid Process 4204 00000F200E592A33.exe - Executes dropped EXE 2 IoCs
pid Process 4204 00000F200E592A33.exe 4460 k32.sys - Loads dropped DLL 1 IoCs
pid Process 4204 00000F200E592A33.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 00000F200E592A33.exe File opened (read-only) \??\X: 00000F200E592A33.exe File opened (read-only) \??\D: 00000F200E592A33.exe File opened (read-only) \??\M: 00000F200E592A33.exe File opened (read-only) \??\Q: 00000F200E592A33.exe File opened (read-only) \??\R: 00000F200E592A33.exe File opened (read-only) \??\T: 00000F200E592A33.exe File opened (read-only) \??\V: 00000F200E592A33.exe File opened (read-only) \??\G: 00000F200E592A33.exe File opened (read-only) \??\I: 00000F200E592A33.exe File opened (read-only) \??\N: 00000F200E592A33.exe File opened (read-only) \??\P: 00000F200E592A33.exe File opened (read-only) \??\U: 00000F200E592A33.exe File opened (read-only) \??\O: 00000F200E592A33.exe File opened (read-only) \??\Y: 00000F200E592A33.exe File opened (read-only) \??\Z: 00000F200E592A33.exe File opened (read-only) \??\B: 00000F200E592A33.exe File opened (read-only) \??\H: 00000F200E592A33.exe File opened (read-only) \??\J: 00000F200E592A33.exe File opened (read-only) \??\K: 00000F200E592A33.exe File opened (read-only) \??\L: 00000F200E592A33.exe File opened (read-only) \??\S: 00000F200E592A33.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe 4204 00000F200E592A33.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe Token: SeDebugPrivilege 4204 00000F200E592A33.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4204 00000F200E592A33.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3872 wrote to memory of 4204 3872 Install_s9ri.exe 88 PID 4204 wrote to memory of 4244 4204 00000F200E592A33.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install_s9ri.exe"C:\Users\Admin\AppData\Local\Temp\Install_s9ri.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\00000F200E592A33.exe"C:\Users\Admin\AppData\Local\Temp\00000F200E592A33.exe" --child "C:\Users\Admin\AppData\Local\Temp\Install_s9ri.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\drivers' -ExclusionProcess 'services.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
PID:4244
-
-
-
C:\Windows\System32\drivers\k32.sysC:\Windows\System32\drivers\k32.sys1⤵
- Executes dropped EXE
PID:4460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\00000F200E592A33.exe
- Size 347KB
- SHA256 e93bfa7cc056600ca5f72727fc6c35f74318c0fe41d989af432efb179a03dd3e
- MD5 b240ef26296ec74d886e08e05065133f
- SHA1 a7daa2090344803aecdd31d641c34e8168baa807
- SHA512 0d0ab0db42fbf7c18b0c631cd81f372f8f39f5691299f0498e2dfe4dbc2edb7cd5235977afa327cce0dd28f16b2c1b78dea5ca52fab740ca430ec685b5304d8d
- SSDEEP 6144:6FmVgbmQ/5mptxFyEKD8zIoVmp/wgSrIu7+/hI1eaEXs/pU1PBPD:UxmQ/q/y7DOIoVmp/YUu7Eawa1WpD
- TLSH T18874E03512CA3774CE7918785E707E0BB27EE60B17D88AC64F7159387243AE32B1E156
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Plg52D9.tmp
- Size 449KB
- SHA256 e5832f3521fb4d56026bd59437c1d25c05cb98d998883e23d8bc280ba6ca2445
- MD5 fd75415d48599164223fae96c72109f7
- SHA1 6dafcfbb82d2e4b70c26971873e2be307e1c7f6f
- SHA512 9af68bf07ad08bc62a1c4bf1749141d50fe2750d74b70d2a021d959b50e2bb32aa8d86d72dd5e23d7906aa2c1e6514ae876a123dcf64030c3cf6159a35489444
- SSDEEP 6144:VEZGTochQs0oT27znNNu37DKYymT1c+ybxlQas+kby6hKhalAK4TCdJwDsY:VEZGhhQFRlmT1cNlRP6OTkm
- TLSH T1C2A48E1AF7A510BAE177C13CC9538916E7B274450760EBDF07608ABA2F237D0AA3D725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\k32.sys
- Size 27KB
- SHA256 b8de157d2ccc5208643470c97e319030581121c51e4d48876cc25b8fbd0adb5a
- MD5 8aa6d49fcc9b4c61954237ac997e350d
- SHA1 79c8f50f166830ca89983c07dbe7493484bf3091
- SHA512 d5dec999369e6405de409f1cb582af8f460b03d5bf210b1cd728486d41793fe82c59008dbc87dccfe808626ccda2f4fccb1d27892becee9e3dfd1bd7aa7aafe5
- SSDEEP 768:E8sFaxUymijHpR8Fuw+vpMtsk0xHupdwdn:E8sqLTjHwU+05mdm
- TLSH T17AD22942639124D6FAFBC6B8D6AA591EBBB0F84347018AEF0564C1A50F737C0793DB19
- MD5 SHA1 SHA512 SSDEEP TLSH