Analysis
- max time kernel
300s - max time network
292s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 13:30
Behavioral task
behavioral1
Sample
สลิปเงินเดือน.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
สลิปเงินเดือน.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
General
- Target สลิปเงินเดือน.exe
- Size 4.1MB
- Sample260806-qrtcgssclb
- SHA256 bd5904de133b7f2ae1cdce7c9054251537c3a442c165f072cf8cae03a264454b
- MD5 af59e1a1632b8a9557fd26fe04bcf536
- SHA1 9215550f79b460b2722184f76ce29adde3b5114b
- SHA512 70d5a21c58757bb5da7bbf45d165de75cf9780b62ed6056a8785b3b8b160ef0f04399f38498e5e3210e6d103a434d8552d7220c63016d4d6b360b6fffdfca73b
- SSDEEP 98304:R5O1lqr1Z+4AiPEZsE5oXssyAHr8+mX/gL7kBO5WIw0XDR6Pktj:L6lqr1c4A2tEd/ao+mXI3kG9t6Pktj
- TLSH T19A16023BF28BB53EE06A1A363A72A110843B7A6065164C5697ECF48CCF655701E3F787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 6 IoCs
resource yara_rule behavioral2/memory/5816-50-0x0000000002C70000-0x0000000002CBD000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5816-58-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5816-59-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5816-52-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5816-60-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5816-61-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 - Executes dropped EXE 2 IoCs
pid Process 4480 สลิปเงินเดือน.tmp 5816 TGFile.exe - Loads dropped DLL 4 IoCs
pid Process 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: TGFile.exe File opened (read-only) \??\O: TGFile.exe File opened (read-only) \??\Q: TGFile.exe File opened (read-only) \??\V: TGFile.exe File opened (read-only) \??\W: TGFile.exe File opened (read-only) \??\L: TGFile.exe File opened (read-only) \??\N: TGFile.exe File opened (read-only) \??\T: TGFile.exe File opened (read-only) \??\X: TGFile.exe File opened (read-only) \??\Y: TGFile.exe File opened (read-only) \??\B: TGFile.exe File opened (read-only) \??\H: TGFile.exe File opened (read-only) \??\I: TGFile.exe File opened (read-only) \??\J: TGFile.exe File opened (read-only) \??\K: TGFile.exe File opened (read-only) \??\M: TGFile.exe File opened (read-only) \??\P: TGFile.exe File opened (read-only) \??\U: TGFile.exe File opened (read-only) \??\D: TGFile.exe File opened (read-only) \??\G: TGFile.exe File opened (read-only) \??\R: TGFile.exe File opened (read-only) \??\S: TGFile.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language สลิปเงินเดือน.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language สลิปเงินเดือน.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/5104-0-0x0000000000100000-0x00000000001E9000-memory.dmp innosetup behavioral2/memory/5104-37-0x0000000000100000-0x00000000001E9000-memory.dmp innosetup - Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64\ = "script:C:\\ProgramLog\\Windows\\AppData\\Local\\Microsoft\\Log\\log.s" TGFile.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64 TGFile.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\TypeLib TGFile.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} TGFile.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1 TGFile.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0 TGFile.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4480 สลิปเงินเดือน.tmp 4480 สลิปเงินเดือน.tmp 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe 5816 TGFile.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4480 สลิปเงินเดือน.tmp - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5816 TGFile.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4480 5104 สลิปเงินเดือน.exe 89 PID 4480 wrote to memory of 5816 4480 สลิปเงินเดือน.tmp 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\สลิปเงินเดือน.exe"C:\Users\Admin\AppData\Local\Temp\สลิปเงินเดือน.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\is-SLL64M1UAA.tmp\สลิปเงินเดือน.tmp"C:\Users\Admin\AppData\Local\Temp\is-SLL64M1UAA.tmp\สลิปเงินเดือน.tmp" /SL5="$4012A,3134288,893952,C:\Users\Admin\AppData\Local\Temp\สลิปเงินเดือน.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe"C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe" "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\Setting.lua"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5816
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\MSVCR100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\Setting.lua
- Size 1.8MB
- SHA256 8a1516bd4960d213e3bfec41bf882502869342d234c9156c772b17a513d21d6b
- MD5 65ba29d95673f631f1f69ca2addf51fb
- SHA1 ba6109597736091417ffe4357d56faf9d7a15550
- SHA512 433ccb8c964090ee488ca8c9103614475f2c73d20718b7b6d70375a0b874146647d6b354537e67b8f2c9f920437390512ebd93ef7e03381776d853c4d074b3df
- SSDEEP 12288:rI2fXtZg0B4gO2sa4tvPayE99OHtVVr080/d8nfuIqAcsuhYltr+1kZ+I8FmfoY/:rI20
- TLSH T1B49511DEA70D55D90DDF33A8EB5649A3BA8499350674828EFFAEC91FF00F81900F1916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\TGFile.exe
- Size 27KB
- SHA256 09cd30b1b25da3ff6661be589d5c31460e51e9ee8e7925df37826456bb8da2bc
- MD5 f1e0d6013f5117046c1b1a048166d225
- SHA1 96bd05457588618be0494ec32c58113443d61459
- SHA512 7544dc4ead8dd9e6b58ab79da62e89afc3c98b73c1562c9053bacbe600b08f4457fbd22f01d7e127960c0d0b4ba5cd8dc375e33f25d4044fc8969c2761b925e8
- SSDEEP 384:TU0xnb4moWtuXDSaa0RXDvuSOf050DcZIYiOJ0Pi/ay8RbmL4nNyNa:RxnbvVu2KRXD2SOMOLYibP6a5ALq
- TLSH T163C28E6A4B651899D617E038F0901617E9B0B2721BA091EF7308CB948F533D3BFBE316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\libepsbase.dll
- Size 262KB
- SHA256 5a2fdc4111ce15f24e9283eb6b135046fdf47b14b193646b61798b72ce3c687c
- MD5 11341b8b8c20a2c3a7f2d3b80899cd0f
- SHA1 b27f270209693de75071003a4a60795bb224688d
- SHA512 9ca1e79949f6c1960ee2cc25a8b8014e6433b9bf6d852600c31cc2c200f7d7d3b679c57b51b24265a1a94f287f201402c66a3f1eabc8c822430150a08dfdf448
- SSDEEP 6144:rVNcb9gwAGl+qDW/lBy5N5PZX9V50DErkkysOYOQE:DcblAGl+D/lB1DBNsOtZ
- TLSH T187449E5AB2640CE8E637B079C566C207F2F27C1D8390E7DF4A60A5541773AE2727D782
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\lua51.dll
- Size 476KB
- SHA256 355e34c71f6b3178092862529382566088aa80abeba67eb09fdf47852889b612
- MD5 09a36334668b5891b1a627e5e8b8203a
- SHA1 bfc2eb1d84bd250cc0f8e86e0553d0f89bf1ae8b
- SHA512 fef60f7e8b6a608587de20b931fc0f23c5c090a01d8dc98a33f55235798936db3e72edf42e7429be90d51fc4a9370d1ac8a21cc50e4aac661f4ce15b8798881e
- SSDEEP 6144:qrPB2x/Z4epBQFAPLVV+iJP/z3qGTR8LPfiK7WBOrqVt/GnNcjnudD1CpZUqWe72:ZDBA+2XiKaB9Ge997L1DCr+kBV8s
- TLSH T1D7A45B49E6740669C5AB807889535D0FD3B6384507A09BDF07E4BBA72B33FD9263B324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\vcruntime140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-SLL64M1UAA.tmp\สลิปเงินเดือน.tmp
- Size 4.2MB
- SHA256 47204e8ed9998a79288c856663a60a420b9b053229d1425f72ca81ae4451867f
- MD5 7b5764ccfa28f2b8c7b125b11237726f
- SHA1 e913da3dfaeba5f56a40b59245c40b082d9ec8ee
- SHA512 205c4da8bf1be67fecd9dd239d9a871e421ed749689a91bfab1587b96713b495c4f9381e45f2f79aaa494571b68963ca4c86370edc4762cabbbbd533166a0ec1
- SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Pe:7xuHjWfZIzee
- TLSH T17A268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
- MD5 SHA1 SHA512 SSDEEP TLSH