Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 06:38
General
- Target 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe
- Size 140KB
- Sample260804-hd2spshm7x
- SHA256 94054a0d2644c8465ab43325f79175f774de269e3145e64f98420699b9b2942e
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
38.246.252.201:6868
-
campaign_date
2026. 7.19
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 34 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"C:\Windows\system32\ThumbnailExtractionHost.exe"2⤵
- Downloads MZ/PE file
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Dawei8588\BarClientView.exeC:\ProgramData\Dawei8588\BarClientView.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\ProgramData\Dawei8588\BarClientView.exeC:\ProgramData\Dawei8588\BarClientView.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BarClientView.exe
log.dll
01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049
0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049
0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
memory/4060-61-0x0000000003B30000-0x0000000003B76000-memory.dmp
memory/4060-65-0x0000000003B30000-0x0000000003B76000-memory.dmp
memory/4060-20-0x0000000010000000-0x000000001001C000-memory.dmp
memory/4060-19-0x0000000010000000-0x000000001001C000-memory.dmp
memory/4060-18-0x0000000010000000-0x000000001001C000-memory.dmp
memory/4060-12-0x0000000010000000-0x000000001001C000-memory.dmp
memory/4060-36-0x0000000002520000-0x000000000255F000-memory.dmp
memory/4060-38-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-37-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-39-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-40-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-41-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-43-0x0000000003AD0000-0x0000000003AF3000-memory.dmp
memory/4060-42-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-54-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-55-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-56-0x0000000002B70000-0x0000000002BB6000-memory.dmp
memory/4060-60-0x0000000003B30000-0x0000000003B76000-memory.dmp
memory/4060-11-0x0000000002500000-0x0000000002518000-memory.dmp
memory/4060-62-0x0000000003B30000-0x0000000003B76000-memory.dmp
memory/4060-63-0x0000000003B30000-0x0000000003B76000-memory.dmp
memory/4060-64-0x0000000003B30000-0x0000000003B76000-memory.dmp
memory/4060-66-0x00000000040C0000-0x00000000040E3000-memory.dmp
memory/4060-21-0x0000000010000000-0x000000001001C000-memory.dmp
memory/4060-78-0x0000000003B30000-0x0000000003B76000-memory.dmp
memory/4060-80-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-81-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-82-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-83-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-87-0x0000000004D20000-0x0000000004D43000-memory.dmp
memory/4060-85-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-84-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-98-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-100-0x0000000004CE0000-0x0000000004D26000-memory.dmp
memory/4060-101-0x0000000004CE0000-0x0000000004D26000-memory.dmp
memory/4060-102-0x0000000004CE0000-0x0000000004D26000-memory.dmp
memory/4060-103-0x0000000004CE0000-0x0000000004D26000-memory.dmp
memory/4060-104-0x0000000004CE0000-0x0000000004D26000-memory.dmp
memory/4060-105-0x0000000004CE0000-0x0000000004D26000-memory.dmp
memory/4060-106-0x0000000004550000-0x0000000004573000-memory.dmp
memory/4060-118-0x0000000004CE0000-0x0000000004D26000-memory.dmp
memory/4060-120-0x00000000047A0000-0x0000000004805000-memory.dmp
memory/4060-119-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-134-0x0000000004080000-0x00000000040C6000-memory.dmp
memory/4060-136-0x0000000004CE0000-0x0000000004D26000-memory.dmp