Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
02/08/2026, 07:55
General
- Target ក្មេងស្រីត្រូវបានរំលោភដោយមនុស្សជា�.exe
- Size 1.4MB
- Sample260802-jsmsrsfc96
- SHA256 7436fc8a7b768a162f3b785404beb61843358bfa43ca86904240c861ad772fff
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 6 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ក្មេងស្រីត្រូវបានរំលោភដោយមនុស្សជា�.exe"C:\Users\Admin\AppData\Local\Temp\ក្មេងស្រីត្រូវបានរំលោភដោយមនុស្សជា�.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c cd /d "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log" && powershell -Command "Expand-Archive -Path setup.zip -DestinationPath . -Force"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path setup.zip -DestinationPath . -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe"C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe" "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\Setting.lua"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MSVCR100.dll
Setting.lua
TGFile.exe
libepsbase.dll
lua51.dll
setup.zip
vcruntime140.dll
nsExec.dll
memory/2340-17-0x0000000005C30000-0x0000000005C7C000-memory.dmp
memory/2340-12-0x0000000005530000-0x0000000005596000-memory.dmp
memory/2340-16-0x0000000005B80000-0x0000000005B9E000-memory.dmp
memory/2340-11-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/2340-18-0x00000000738C0000-0x000000007407C000-memory.dmp
memory/2340-19-0x0000000006B90000-0x0000000006BC6000-memory.dmp
memory/2340-20-0x0000000070260000-0x00000000702AC000-memory.dmp
memory/2340-24-0x00000000738C0000-0x000000007407C000-memory.dmp
memory/2340-23-0x0000000006B70000-0x0000000006B90000-memory.dmp
memory/2340-25-0x00000000738C0000-0x000000007407C000-memory.dmp
memory/2340-26-0x0000000006BD0000-0x0000000006C73000-memory.dmp
memory/2340-27-0x0000000007530000-0x0000000007BAC000-memory.dmp
memory/2340-28-0x0000000006EF0000-0x0000000006F0A000-memory.dmp
memory/2340-29-0x0000000006F60000-0x0000000006F6A000-memory.dmp
memory/2340-30-0x0000000007160000-0x00000000071F6000-memory.dmp
memory/2340-31-0x00000000070E0000-0x00000000070F1000-memory.dmp
memory/2340-32-0x0000000007220000-0x0000000007242000-memory.dmp
memory/2340-33-0x0000000008170000-0x000000000872A000-memory.dmp
memory/2340-34-0x00000000738C0000-0x000000007407C000-memory.dmp
memory/2340-15-0x00000000056B0000-0x0000000005A0B000-memory.dmp
memory/2340-36-0x00000000072D0000-0x00000000072DA000-memory.dmp
memory/2340-35-0x00000000072E0000-0x00000000072F2000-memory.dmp
memory/2340-53-0x00000000738C0000-0x000000007407C000-memory.dmp
memory/2340-10-0x0000000004DA0000-0x0000000004DC2000-memory.dmp
memory/2340-9-0x00000000738C0000-0x000000007407C000-memory.dmp
memory/2340-8-0x0000000004E00000-0x000000000544A000-memory.dmp
memory/2340-7-0x00000000738C0000-0x000000007407C000-memory.dmp
memory/2340-6-0x00000000026B0000-0x00000000026E6000-memory.dmp
memory/2340-5-0x00000000738D2000-0x00000000738D3000-memory.dmp
memory/4388-69-0x00007FFE314A0000-0x00007FFE314B0000-memory.dmp
memory/4388-70-0x00007FFE314A0000-0x00007FFE314B0000-memory.dmp
memory/4388-78-0x0000000180000000-0x0000000180055000-memory.dmp
memory/4388-79-0x0000000180000000-0x0000000180055000-memory.dmp
memory/4388-72-0x0000000180000000-0x0000000180055000-memory.dmp
memory/4388-71-0x0000000002AF0000-0x0000000002B3D000-memory.dmp
memory/4388-68-0x00007FFE314A0000-0x00007FFE314B0000-memory.dmp
memory/4388-67-0x00007FFE314A0000-0x00007FFE314B0000-memory.dmp
memory/4388-80-0x0000000180000000-0x0000000180055000-memory.dmp
memory/4388-81-0x0000000180000000-0x0000000180055000-memory.dmp