General
- Target 7504810d12072e2516a87cdc321b94554ac93e1c71d45498dd89bd47904723bd
- Size 2.0MB
- Sample260802-rbyspsthrd
- SHA256 7504810d12072e2516a87cdc321b94554ac93e1c71d45498dd89bd47904723bd
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
154.12.19.70:22011
-
154.12.19.70:22012
Targets
-
- Target 7504810d12072e2516a87cdc321b94554ac93e1c71d45498dd89bd47904723bd
- Size 2.0MB
- SHA256 7504810d12072e2516a87cdc321b94554ac93e1c71d45498dd89bd47904723bd
Score10/10-
Detects ValleyRAT payload
-
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies Windows Defender notification settings
-
Modifies firewall policy service
-
UAC bypass
-
Windows security bypass
-
Server Software Component: Terminal Services DLL
-
Boot or Logon Autostart Execution: LSASS Driver
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
4Windows Service
4Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
4Windows Service
4Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
7Disable or Modify System Firewall
1Disable or Modify Tools
6Modify Registry
8