Analysis
- geolocation tags
asiadelhiinindia - user interaction
yes - max time kernel
116s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:22
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Statement of Account.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Statement of Account.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
winhttp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
winhttp.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Statement of Account.exe
- Size 25KB
- Sample260804-g44vbashlf
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
- MD5 e6363b8ec386338ce08f159a739f0e97
- SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
- SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
- SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
- TLSH T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.75.119.86:5353
Attributes
-
campaign_date
2026-08-04
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 1 IoCs
resource yara_rule behavioral2/memory/3372-10-0x0000026E0CBC0000-0x0000026E0CC1E000-memory.dmp family_valleyrat_stage_2_v2 - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Statement of Account.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Statement of Account.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Statement of Account.exe File opened (read-only) \??\S: Statement of Account.exe File opened (read-only) \??\T: Statement of Account.exe File opened (read-only) \??\Y: Statement of Account.exe File opened (read-only) \??\Z: Statement of Account.exe File opened (read-only) \??\G: Statement of Account.exe File opened (read-only) \??\H: Statement of Account.exe File opened (read-only) \??\K: Statement of Account.exe File opened (read-only) \??\P: Statement of Account.exe File opened (read-only) \??\Q: Statement of Account.exe File opened (read-only) \??\V: Statement of Account.exe File opened (read-only) \??\W: Statement of Account.exe File opened (read-only) \??\B: Statement of Account.exe File opened (read-only) \??\I: Statement of Account.exe File opened (read-only) \??\M: Statement of Account.exe File opened (read-only) \??\U: Statement of Account.exe File opened (read-only) \??\D: Statement of Account.exe File opened (read-only) \??\O: Statement of Account.exe File opened (read-only) \??\X: Statement of Account.exe File opened (read-only) \??\J: Statement of Account.exe File opened (read-only) \??\L: Statement of Account.exe File opened (read-only) \??\N: Statement of Account.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe 3372 Statement of Account.exe - Suspicious behavior: LoadsDriver 18 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 808 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3372 Statement of Account.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"C:\Users\Admin\AppData\Local\Temp\Statement of Account.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵PID:4144
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1