Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 07:55
General
- Target ក្មេងស្រីត្រូវបានរំលោភដោយមនុស្សជា�.exe
- Size 1.4MB
- Sample260802-jsmsrsfc96
- SHA256 7436fc8a7b768a162f3b785404beb61843358bfa43ca86904240c861ad772fff
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 6 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ក្មេងស្រីត្រូវបានរំលោភដោយមនុស្សជា�.exe"C:\Users\Admin\AppData\Local\Temp\ក្មេងស្រីត្រូវបានរំលោភដោយមនុស្សជា�.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c cd /d "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log" && powershell -Command "Expand-Archive -Path setup.zip -DestinationPath . -Force"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path setup.zip -DestinationPath . -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe"C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe" "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\Setting.lua"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MSVCR100.dll
Setting.lua
TGFile.exe
VCRUNTIME140.dll
libepsbase.dll
lua51.dll
setup.zip
__PSScriptPolicyTest_jzbqgsfu.kfc.ps1
nsExec.dll
memory/2652-82-0x0000000180000000-0x0000000180055000-memory.dmp
memory/2652-89-0x0000000180000000-0x0000000180055000-memory.dmp
memory/2652-88-0x0000000180000000-0x0000000180055000-memory.dmp
memory/2652-80-0x00007FFE86B30000-0x00007FFE86B40000-memory.dmp
memory/2652-81-0x0000000002EC0000-0x0000000002F0D000-memory.dmp
memory/2652-79-0x00007FFE86B30000-0x00007FFE86B40000-memory.dmp
memory/2652-78-0x00007FFE86B30000-0x00007FFE86B40000-memory.dmp
memory/2652-91-0x0000000180000000-0x0000000180055000-memory.dmp
memory/2652-90-0x0000000180000000-0x0000000180055000-memory.dmp
memory/2652-77-0x00007FFE86B30000-0x00007FFE86B40000-memory.dmp
memory/4844-21-0x0000000005CA0000-0x0000000005CEC000-memory.dmp
memory/4844-33-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/4844-38-0x0000000006FF0000-0x0000000006FFA000-memory.dmp
memory/4844-39-0x0000000007220000-0x00000000072B6000-memory.dmp
memory/4844-40-0x0000000007190000-0x00000000071A1000-memory.dmp
memory/4844-41-0x00000000072F0000-0x0000000007312000-memory.dmp
memory/4844-42-0x0000000008200000-0x00000000087A4000-memory.dmp
memory/4844-43-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/4844-44-0x0000000007390000-0x00000000073A2000-memory.dmp
memory/4844-45-0x0000000007380000-0x000000000738A000-memory.dmp
memory/4844-36-0x00000000075D0000-0x0000000007C4A000-memory.dmp
memory/4844-35-0x0000000006C50000-0x0000000006CF3000-memory.dmp
memory/4844-32-0x0000000006C30000-0x0000000006C4E000-memory.dmp
memory/4844-37-0x0000000006F90000-0x0000000006FAA000-memory.dmp
memory/4844-34-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/4844-24-0x00000000708E0000-0x000000007092C000-memory.dmp
memory/4844-23-0x0000000006230000-0x0000000006262000-memory.dmp
memory/4844-22-0x000000007F530000-0x000000007F540000-memory.dmp
memory/4844-20-0x0000000005C60000-0x0000000005C7E000-memory.dmp
memory/4844-19-0x0000000005690000-0x00000000059E4000-memory.dmp
memory/4844-11-0x0000000005620000-0x0000000005686000-memory.dmp
memory/4844-10-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/4844-9-0x0000000004CB0000-0x0000000004CD2000-memory.dmp
memory/4844-8-0x0000000004E10000-0x0000000005438000-memory.dmp
memory/4844-7-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/4844-6-0x0000000002680000-0x00000000026B6000-memory.dmp
memory/4844-5-0x00000000026F0000-0x0000000002700000-memory.dmp