Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe
- Size 140KB
- Sample260804-hd2spshm7x
- SHA256 94054a0d2644c8465ab43325f79175f774de269e3145e64f98420699b9b2942e
- MD5 7f884361e88bd131619a4e9e52bc69cf
- SHA1 6cf200ecad915c01257a44b05671e6f4b4513423
- SHA512 80bf9adb2e8274e8773ad76c37cccce6f8064343aec8a65118ec957a148d71292b321987af6be8aa34af0f98cc764ecf7fa5e8d9efc4ec46ed9bc3160cd1395b
- SSDEEP 3072:tGry4HuzTblegqYvZVFFECy4tTP+dEM8QRU5PrHmO2h38:tGrZHY5jFV7eqjxbDGN6
- TLSH T1EDE38D01F9D1C436D67A0D318854CE658E3FFCA14FA0ADEB73981DEA0E346D0AB39656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
38.246.252.201:6868
Attributes
-
campaign_date
2026. 7.19
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 17 IoCs
resource yara_rule behavioral2/memory/2068-36-0x0000000004D60000-0x0000000004D9F000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-37-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-38-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-39-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-41-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-40-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-42-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-54-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-56-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/2068-55-0x0000000004DA0000-0x0000000004DE6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3264-60-0x0000000004590000-0x00000000045D6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3264-61-0x0000000004590000-0x00000000045D6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3264-63-0x0000000004590000-0x00000000045D6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3264-62-0x0000000004590000-0x00000000045D6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3264-64-0x0000000004590000-0x00000000045D6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3264-65-0x0000000004590000-0x00000000045D6000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/3264-78-0x0000000004590000-0x00000000045D6000-memory.dmp family_valleyrat_stage_2_v2 - Downloads MZ/PE file 1 IoCs
flow pid Process 16 5836 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe - Executes dropped EXE 2 IoCs
pid Process 2068 BarClientView.exe 3264 BarClientView.exe - Loads dropped DLL 2 IoCs
pid Process 2068 BarClientView.exe 3264 BarClientView.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: BarClientView.exe File opened (read-only) \??\Q: BarClientView.exe File opened (read-only) \??\D: BarClientView.exe File opened (read-only) \??\D: BarClientView.exe File opened (read-only) \??\P: BarClientView.exe File opened (read-only) \??\X: BarClientView.exe File opened (read-only) \??\H: BarClientView.exe File opened (read-only) \??\U: BarClientView.exe File opened (read-only) \??\V: BarClientView.exe File opened (read-only) \??\Z: BarClientView.exe File opened (read-only) \??\K: BarClientView.exe File opened (read-only) \??\V: BarClientView.exe File opened (read-only) \??\W: BarClientView.exe File opened (read-only) \??\Z: BarClientView.exe File opened (read-only) \??\Q: BarClientView.exe File opened (read-only) \??\B: BarClientView.exe File opened (read-only) \??\J: BarClientView.exe File opened (read-only) \??\U: BarClientView.exe File opened (read-only) \??\B: BarClientView.exe File opened (read-only) \??\I: BarClientView.exe File opened (read-only) \??\R: BarClientView.exe File opened (read-only) \??\W: BarClientView.exe File opened (read-only) \??\R: BarClientView.exe File opened (read-only) \??\T: BarClientView.exe File opened (read-only) \??\J: BarClientView.exe File opened (read-only) \??\L: BarClientView.exe File opened (read-only) \??\X: BarClientView.exe File opened (read-only) \??\S: BarClientView.exe File opened (read-only) \??\P: BarClientView.exe File opened (read-only) \??\Y: BarClientView.exe File opened (read-only) \??\G: BarClientView.exe File opened (read-only) \??\H: BarClientView.exe File opened (read-only) \??\I: BarClientView.exe File opened (read-only) \??\N: BarClientView.exe File opened (read-only) \??\K: BarClientView.exe File opened (read-only) \??\M: BarClientView.exe File opened (read-only) \??\O: BarClientView.exe File opened (read-only) \??\Y: BarClientView.exe File opened (read-only) \??\G: BarClientView.exe File opened (read-only) \??\N: BarClientView.exe File opened (read-only) \??\S: BarClientView.exe File opened (read-only) \??\T: BarClientView.exe File opened (read-only) \??\L: BarClientView.exe File opened (read-only) \??\M: BarClientView.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BarClientView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BarClientView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5836 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe 5836 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe 5836 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe 5836 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe 2068 BarClientView.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5836 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe Token: SeDebugPrivilege 2068 BarClientView.exe Token: SeDebugPrivilege 3264 BarClientView.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2068 BarClientView.exe 3264 BarClientView.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5836 wrote to memory of 2068 5836 2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7f884361e88bd131619a4e9e52bc69cf_amadey_cobalt-strike_elex_play.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\ProgramData\Dawei8588\BarClientView.exeC:\ProgramData\Dawei8588\BarClientView.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
C:\ProgramData\Dawei8588\BarClientView.exeC:\ProgramData\Dawei8588\BarClientView.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Dawei8588\BarClientView.exe
- Size 804KB
- SHA256 ef5567d00b3f0268435594f5069a660533188d84f43be8bc6c54e9ade87fbb4d
- MD5 424c14ba07ee318c83aeaaf5b8177c3f
- SHA1 ac5d216c2bc896ec2ea5ec3e9f9bfd501dc7e212
- SHA512 b73bf215dd6a943319e83094d0e5366fa2d3779d789c99e9b54d0d0e6f98ffddef63f5a3a4cff7afa0f2064b6d7552f9ee6c356d180c8685f5549fea341faf35
- SSDEEP 6144:80CjWRFoM9HmpqF+OnaAOnbEY2aQfQc4kxQEs/1vTzLwSHW:jCiRFoM9Dxa1IYJZvTYS2
- TLSH T1D10529D1B08042B1F7AB1E3020BAAE35066B6FBA9DD8B15FE64476753BF71C22123517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Dawei8588\log.dll
- Size 1.9MB
- SHA256 6e332f0f36e78bdb4ae8dc983f9c32e57fd4c0768b99b6b00867752c25f5f2d5
- MD5 21e9fc847cedf082e39d7b76667f110c
- SHA1 e8272f249e8106dc47147c8c579c9dce0b5db68e
- SHA512 8dfe5c886e5bc7d62546ab8368116b46e6fa48d27eeddf70bb9a4ec50abdb714df5f7943b2382ccce7f9b4759ff2cfd385e05034d2c782f9893f4eda38d4db07
- SSDEEP 49152:lZrkAqsefhSUD1yxFI0TBAcOcTDwW428/XP43:lOhffhScsI6BA2HwW428i
- TLSH T1B0957C127A4004B6D19A1234592DF279F2BC6DB32B7B42CB1FD49A5C3DF34C24A2979E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049
- Size 1KB
- SHA256 df794c918cc818d3fbfc9aca5b210f9ef360dcc269760feb5d2edb5b9234a454
- MD5 54eecfc1be0a36170c5813b954c21931
- SHA1 2e885cc1d447ed5c8b582140a551270ccc4ac7ba
- SHA512 dda403ef27814f4a0ae7c822a783723c664c4d24e6cc457c7f2fa3e5edc49c6025c8f15e5855b6c1d4559ee998f1d9e266da1e47ec7159f1231f5c4cd23edd30
- TLSH T1BB21A4966D3EB5433B449D4A18CC87338CF092CDC9E25A262519B5579D80741BE8B80C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
- Size 1KB
- SHA256 8f379ee7967f919a8043ec9e73f2279cb31382d136fbd218cb87310f648a3bf8
- MD5 e54a9d8ece5fc136b3a46251920c99c3
- SHA1 cd4fbb5ea8aa1f6ba4f5f2399d8f1c29d50b7d93
- SHA512 bb635ed1453146f1345c5a59de6655e3ef3fafe8f3e4eee423da0a59d6fc0f468141f8e209cb631bd1774775855a7382a2c8620b59220d46a6ea067cbc55833f
- TLSH T1B531E9AE8EB125D0BFC0AE4236C9E93B3DE617C30DAD518B5331A5EA16003923E1781D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
- Size 1KB
- SHA256 af46823efb412ba0d7be6125f03b08df388ba7fa32d42068a58c4c126658ed8e
- MD5 fa436a6073c0f87ca8b91c248b8b49af
- SHA1 7f31d287309e817b37f6cfc1d6d19069ce9f8524
- SHA512 37c46ef7c9d42af6549dac9785ee849113d740584231741b2ae88e2e9e45a700e303c19d7c1470ab06849ae786ded7f637c09752d283e0e6186df5087868e596
- TLSH T1743194870B2D2007FFC7CE5795D4DAA37CF485D1989408A4D01E62A7A8107BA6E4ED8A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049
- Size 546B
- SHA256 48a386736fee2acc9fa88d7df40539d2109d0f294a30a7bf621ef474f1aa99de
- MD5 ce67c30a3bd664a09be53d8849528772
- SHA1 d4ae6e138a657f8f36b27d852b6267d17d62c2a6
- SHA512 ec9e0488c2741269c4f6a23ffab17f05ff3b7d5f0012ee4c68f802080a73e313d327c4d838fcb4801076fe94010e25f1e66a7955086ad90cec2af3968b667ef3
- TLSH T12CF0592858AA811EF136D8395BD636278D64F61A340081751ED697087B16D01BCA2B1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
- Size 512B
- SHA256 55d6e6caf0fdac4f2c4262dbb212a9333114788166c89b3b37e8ee383206c135
- MD5 049e43d5e7ba9dc4359030fb62ce27f1
- SHA1 8839d48b1200c171e2b96d76df62e73c4e2e8d6f
- SHA512 bb95e4a681474f87293acd0e7936f07d132ca52d39a1283b4c2e359e40b9c3d18398e2856a25628933dbb81526c8d8bf31eb60be53eee163e3c26c27ef96c52f
- TLSH T1DDF06108097D813EF233DE3C87C935EA1ABFE603380649E405A9470DEB83A067D5167A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
- Size 512B
- SHA256 ff0d42a7120ee31fc371219cfe4b0b266f4ba17763c5e499d56c3c08006a896d
- MD5 55fa9f68d78c2281519bd73a2dde1309
- SHA1 7a9fe947f68cc3cc5d0e27bfe7625619605ac8d0
- SHA512 0ff3a2016bacd5c1e57354cc8d4bb600ccf4c0e8ea399c191dae24b564d12a5c219bdac36ac93cf2c0fb341bee34c26d147cfd67f82923c0912af5f70570367b
- TLSH T1C2F05C040978813EF233D93C87CA39A6166FF647780685E40FA94708A642A066D51575
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
- Size 506B
- SHA256 0099af360c52bca39f5f108f32c84f8aaf6518adbe8bfb26649afadc28d2589d
- MD5 80c60c400551cc98c0a296c865f89e4f
- SHA1 8f4f8db43edadb2086b5427148e62e04e89859bc
- SHA512 01763866572d06a5838275069caf0d2ff69a9c36625d354ddbbaeccccce00fc5e4ea0e3073a53284aef9f4054334f162a6500445da9669c10cb2bdeed96253a5
- TLSH T1E8F05C3595D9023FF076E6B48AD63A725A25E623100757BE0FA916486F55D005C4126D
- MD5 SHA1 SHA512 TLSH