valleyrat_s2 | b9f992a46caa3b898a960ceb13b8be215054e74d80b288de82b662c028faecb6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7A0F3EEBFB821131F22FF6EC2645B4FC.exe
Size 198KB
Sample260813-lrfdeaaa54
SHA256 b9f992a46caa3b898a960ceb13b8be215054e74d80b288de82b662c028faecb6
MD5 7a0f3eebfb821131f22ff6ec2645b4fc
SHA1 91763fd9896d4e7c17058d566e903a94ab801127
SHA512 85d90936597ef30e09d21b313eecb13b65aa0ef607e11dda60c0ddaa0c7d6926107920fe021e00f39552e083f88e8f2af72b6345526a371e4d035c9e47790b76
SSDEEP 3072:Ln7iRSW/iMxzLifVK+N/sZIGZEjUR2RcAIuO+9ggggggtnKZjeDlV34XNojF9ubI:z7s7z+Qc35FhO+bnkKDlpUNoxM/c
TLSH
T1C0148D54FDC48826F236097019A6E565112BFCE99BA1ADCF274463AE4E332C2D437CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

8.210.155.34:6868

Attributes

campaign_date
2026. 8. 5

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 18 IoCs

resource	yara_rule
behavioral2/memory/5604-36-0x0000000003EC0000-0x0000000003EFF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-38-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-37-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-39-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-40-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-41-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-53-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-42-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-58-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-57-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-59-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-70-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-71-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-85-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-107-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-128-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-129-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5604-146-0x0000000003F00000-0x0000000003F46000-memory.dmp	family_valleyrat_stage_2_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5548	powershell.exe
5804	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
13	4648	7A0F3EEBFB821131F22FF6EC2645B4FC.exe
13	4648	7A0F3EEBFB821131F22FF6EC2645B4FC.exe

Executes dropped EXE 2 IoCs

pid	Process
5604	ZhiMaSkin.exe
5140	ZhiMaSkin.exe

Loads dropped DLL 4 IoCs

pid	Process
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5140	ZhiMaSkin.exe
5140	ZhiMaSkin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\rentVer = "C:\\ProgramData\\NGT955888\\ZhiMaSkin.exe"	ZhiMaSkin.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	ZhiMaSkin.exe
File opened (read-only)	\??\S:	ZhiMaSkin.exe
File opened (read-only)	\??\B:	ZhiMaSkin.exe
File opened (read-only)	\??\J:	ZhiMaSkin.exe
File opened (read-only)	\??\Q:	ZhiMaSkin.exe
File opened (read-only)	\??\T:	ZhiMaSkin.exe
File opened (read-only)	\??\V:	ZhiMaSkin.exe
File opened (read-only)	\??\W:	ZhiMaSkin.exe
File opened (read-only)	\??\G:	ZhiMaSkin.exe
File opened (read-only)	\??\I:	ZhiMaSkin.exe
File opened (read-only)	\??\K:	ZhiMaSkin.exe
File opened (read-only)	\??\N:	ZhiMaSkin.exe
File opened (read-only)	\??\O:	ZhiMaSkin.exe
File opened (read-only)	\??\R:	ZhiMaSkin.exe
File opened (read-only)	\??\X:	ZhiMaSkin.exe
File opened (read-only)	\??\D:	ZhiMaSkin.exe
File opened (read-only)	\??\L:	ZhiMaSkin.exe
File opened (read-only)	\??\M:	ZhiMaSkin.exe
File opened (read-only)	\??\P:	ZhiMaSkin.exe
File opened (read-only)	\??\U:	ZhiMaSkin.exe
File opened (read-only)	\??\Y:	ZhiMaSkin.exe
File opened (read-only)	\??\Z:	ZhiMaSkin.exe

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2992	tasklist.exe
3064	tasklist.exe
4992	tasklist.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2688	cmd.exe
5956	cmd.exe
2620	cmd.exe
252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZhiMaSkin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZhiMaSkin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A0F3EEBFB821131F22FF6EC2645B4FC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
5884	timeout.exe
4660	timeout.exe
2004	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe
5604	ZhiMaSkin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeDebugPrivilege	2992	tasklist.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeIncreaseQuotaPrivilege	5804	powershell.exe
Token: SeSecurityPrivilege	5804	powershell.exe
Token: SeTakeOwnershipPrivilege	5804	powershell.exe
Token: SeLoadDriverPrivilege	5804	powershell.exe
Token: SeSystemProfilePrivilege	5804	powershell.exe
Token: SeSystemtimePrivilege	5804	powershell.exe
Token: SeProfSingleProcessPrivilege	5804	powershell.exe
Token: SeIncBasePriorityPrivilege	5804	powershell.exe
Token: SeCreatePagefilePrivilege	5804	powershell.exe
Token: SeBackupPrivilege	5804	powershell.exe
Token: SeRestorePrivilege	5804	powershell.exe
Token: SeShutdownPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeSystemEnvironmentPrivilege	5804	powershell.exe
Token: SeRemoteShutdownPrivilege	5804	powershell.exe
Token: SeUndockPrivilege	5804	powershell.exe
Token: SeManageVolumePrivilege	5804	powershell.exe
Token: 33	5804	powershell.exe
Token: 34	5804	powershell.exe
Token: 35	5804	powershell.exe
Token: 36	5804	powershell.exe
Token: SeIncreaseQuotaPrivilege	5804	powershell.exe
Token: SeSecurityPrivilege	5804	powershell.exe
Token: SeTakeOwnershipPrivilege	5804	powershell.exe
Token: SeLoadDriverPrivilege	5804	powershell.exe
Token: SeSystemProfilePrivilege	5804	powershell.exe
Token: SeSystemtimePrivilege	5804	powershell.exe
Token: SeProfSingleProcessPrivilege	5804	powershell.exe
Token: SeIncBasePriorityPrivilege	5804	powershell.exe
Token: SeCreatePagefilePrivilege	5804	powershell.exe
Token: SeBackupPrivilege	5804	powershell.exe
Token: SeRestorePrivilege	5804	powershell.exe
Token: SeShutdownPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeSystemEnvironmentPrivilege	5804	powershell.exe
Token: SeRemoteShutdownPrivilege	5804	powershell.exe
Token: SeUndockPrivilege	5804	powershell.exe
Token: SeManageVolumePrivilege	5804	powershell.exe
Token: 33	5804	powershell.exe
Token: 34	5804	powershell.exe
Token: 35	5804	powershell.exe
Token: 36	5804	powershell.exe
Token: SeIncreaseQuotaPrivilege	5804	powershell.exe
Token: SeSecurityPrivilege	5804	powershell.exe
Token: SeTakeOwnershipPrivilege	5804	powershell.exe
Token: SeLoadDriverPrivilege	5804	powershell.exe
Token: SeSystemProfilePrivilege	5804	powershell.exe
Token: SeSystemtimePrivilege	5804	powershell.exe
Token: SeProfSingleProcessPrivilege	5804	powershell.exe
Token: SeIncBasePriorityPrivilege	5804	powershell.exe
Token: SeCreatePagefilePrivilege	5804	powershell.exe
Token: SeBackupPrivilege	5804	powershell.exe
Token: SeRestorePrivilege	5804	powershell.exe
Token: SeShutdownPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeSystemEnvironmentPrivilege	5804	powershell.exe
Token: SeRemoteShutdownPrivilege	5804	powershell.exe
Token: SeUndockPrivilege	5804	powershell.exe
Token: SeManageVolumePrivilege	5804	powershell.exe
Token: 33	5804	powershell.exe
Token: 34	5804	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5604	ZhiMaSkin.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5604	4648	7A0F3EEBFB821131F22FF6EC2645B4FC.exe	89
PID 5604 wrote to memory of 2688	5604	ZhiMaSkin.exe	92
PID 2688 wrote to memory of 6132	2688	cmd.exe	94
PID 5604 wrote to memory of 5956	5604	ZhiMaSkin.exe	95
PID 5956 wrote to memory of 5548	5956	cmd.exe	97
PID 5604 wrote to memory of 2620	5604	ZhiMaSkin.exe	98
PID 2620 wrote to memory of 2992	2620	cmd.exe	100
PID 2620 wrote to memory of 3268	2620	cmd.exe	101
PID 2620 wrote to memory of 5884	2620	cmd.exe	103
PID 5604 wrote to memory of 252	5604	ZhiMaSkin.exe	104
PID 252 wrote to memory of 5804	252	cmd.exe	106
PID 2620 wrote to memory of 3064	2620	cmd.exe	108
PID 2620 wrote to memory of 5412	2620	cmd.exe	109
PID 2620 wrote to memory of 4660	2620	cmd.exe	110
PID 2620 wrote to memory of 4992	2620	cmd.exe	111
PID 2620 wrote to memory of 5928	2620	cmd.exe	112
PID 2620 wrote to memory of 2004	2620	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\7A0F3EEBFB821131F22FF6EC2645B4FC.exe
"C:\Users\Admin\AppData\Local\Temp\7A0F3EEBFB821131F22FF6EC2645B4FC.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\ProgramData\NGT955888\ZhiMaSkin.exe
  C:\ProgramData\NGT955888\ZhiMaSkin.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C schtasks /query /tn "MicrosoftWindowsUpdate" > "C:\Users\Admin\AppData\Local\Temp\\~tmp_out_5604.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "MicrosoftWindowsUpdate"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C powershell -Command Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\\svchost_tmp.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq ZhiMaSkin.exe"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2992
  - - C:\Windows\SysWOW64\find.exe
      find /I "ZhiMaSkin.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3268
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 30 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5884
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq ZhiMaSkin.exe"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      PID:3064
  - - C:\Windows\SysWOW64\find.exe
      find /I "ZhiMaSkin.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 30 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4660
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq ZhiMaSkin.exe"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      PID:4992
  - - C:\Windows\SysWOW64\find.exe
      find /I "ZhiMaSkin.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5928
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 30 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\ge6h88xr.ps1" > "C:\Users\Admin\AppData\Local\ge6h88xr.tmp" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\ge6h88xr.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5804

C:\ProgramData\NGT955888\ZhiMaSkin.exe
C:\ProgramData\NGT955888\ZhiMaSkin.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZhiMaSkin.exe

Path C:\ProgramData\NGT955888\ZhiMaSkin.exe
Size 4.3MB
SHA256 9556b7d5bb6e1db6ea73e2d20ef2c1edb46a645a5324570b717941aa2d0e40cd
MD5 5be09b108a180738af42f70bf8566f52
SHA1 42ee23f2345c19e0c53f285a9b041b8ba33f4404
SHA512 6a5769a3d903412415710a049a8508f3cfbd72a1eadc222dd41948e3325c06e5c9d501cea390be9c045c4302fe4413baa8e7bd9e48d2800bd250c6143ec9a049
SSDEEP 49152:ZIsYo7wb2OLGGtqCXNApIDBZL4tEfFEsH2aJ3Aoc/DN6GyVnoLn1v:BPCP3Ai94tYet4AoKDN66Z
TLSH
T19E26CF03F982DC21D94866B165FC66A3567B0FB04B6098CBEED898274D301E5DC7EAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZhiMaUpdate.dll

Path C:\ProgramData\NGT955888\ZhiMaUpdate.dll
Size 110KB
SHA256 2d566f10587833b70b7b042e1fedd3d0b04116a17eafcb6e36c78185d1f1b919
MD5 adc04564bc5fdf3cf7279770c19765d7
SHA1 e60431082e346c76d21d71b7bee3eb7376265a58
SHA512 ea47882f53ea946645ac4982504b23d59e61f410caec7618947d882b9479ec9740af925df94a58d89caf45504f6eb43acf6574f74d8873ce1953336580b3426b
SSDEEP 3072:JwdT/mVlsQPm57PFNjtoPgqKu3uwXZk9fN16:20Te7tNB0kRY
TLSH
T1D4B34A11B891D036D7AE0C788815DA619F7D7C91DFE0ACD777941EEA0E70AC0AF39A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\ProgramData\NGT955888\libcurl.dll
Size 978KB
SHA256 6bcde8c9d5c7198816b4dcfe39427e421d50a1e7dedb000901fced1cf6a66a6f
MD5 f892c56edc5d59dd12647b076bbbf39c
SHA1 af2e6cb62952d7170976be4f88969c00707b5cbd
SHA512 636b88da9f60a58ba7ec017f08681d521f94be500536686db228163bec06f58cf5c8a6c98481ccfb729700ee458b404b6d5391ff5c29e26dff4a3b3f4d5f0277
SSDEEP 12288:PBjeGFwylD+fbntOZ/xy7w7FluYNRVTGDvhOwAfEQ+bxtZITEdsLfvbIPUepO4Xw:JpItK/xX7Lj3T0vhOwAfUZIuMepFXrk
TLSH
T119257C22BC80C032E5E21476A2BD8FB65D6D55302739A0DBA7D818B59E700D3B73D76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 d6d97b7924c63293800fe8706d02770b940172c36cbc7ee5a00a790da0bd56f1
MD5 7f6abfa0c9328b6d9eeb6494fb340970
SHA1 883e45a72a6bcfcda469f5cde2d90289ec2b33c7
SHA512 98c7b1894e77976688a5ee87b5850a5e7049a69335c4d19017104cd3bd1ae9e6e72f3919e58c64dea318fc506b1d46d4c5e026670e6ee06cf62db7860ea27a02
SSDEEP 384:h1eB11T1iBjXW14bmg3ByUvt0/CsrbVRdIAXr4B+hWoutzKwEvYbhNaPWlRvF9:7eNZ67WiDRyUl6nhIAXrq+6V7bhNaPuX
TLSH
T1817297A8617F5DC7D89122B410D602E7FBA4E48CDF765198FE27CE2B1C90EBB4B60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3q42l33k.ump.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3q42l33k.ump.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\svchost_tmp.bat
Size 614B
SHA256 88b40fb80183d4ba737daa441ddb09b53c980a5976bc8d2fc104ff64507cc160
MD5 4399cea89220966efa9b68213b63352b
SHA1 e89a32d4b47def8af12ae4a4a142b8dd388d982a
SHA512 fc44387fa4a57b042a8c68d46527a9c95682d0fe992392766f54ef2ad131f59260743e04e654a4f0ac0dac691e99c6c7537fc31529c7a95accce83283ea461fd
TLSH
T196F028159299528504E91163A67DBD8BD36EC94567C8F3C9B020C8AE61CE80AF28D394
MD5 SHA1 SHA512 TLSH

Submit Download

ge6h88xr.ps1

Path C:\Users\Admin\AppData\Local\ge6h88xr.ps1
Size 521B
SHA256 a17d529dca2825e362c9ce87b92376bcd6a0822134480867c7146973da0e2f01
MD5 c970d80b563cbfc32c01c7d5b944ba6f
SHA1 14d358d42ab3e746a25b6c5207eca5ac44d23425
SHA512 1f60a326d8caecc78587f28112176c2af5eeeedc8b4535225c7170c7e65afc37f0c4fa82441d965a995e6d2ca75a98bfa7b11ee24aa37c9fbb1d19cc42a47097
TLSH
T1C6F05932F61070BF9D0A143CC883A6C064B151BF9736A868B42489287FD68BFD30189A
MD5 SHA1 SHA512 TLSH

Submit Download

ge6h88xr.tmp

Path C:\Users\Admin\AppData\Local\ge6h88xr.tmp
Size 9B
SHA256 421a244564c34296e185cdcf70d2269227ae102f2e7eeef94afddd495c4e06c2
MD5 e6a14ea593393eea75c2d790134766f3
SHA1 36b5cac6f1bbdddd0a98ff0fa64d9d093a7d41ac
SHA512 9d2882c5161a6e57583f0fd60d46d54441f41a24122bea26ca45dd95d05ef4363a2be85704d66898b07be1cfbdc87d58861c4265211da24dedb84ff07ed06773
MD5 SHA1 SHA512

Submit Download

memory/4648-11-0x0000000004850000-0x0000000004868000-memory.dmp

Download

memory/4648-12-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/4648-17-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/4648-18-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/4648-19-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/4648-20-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/5548-123-0x0000000007930000-0x00000000079D3000-memory.dmp

Download

memory/5548-117-0x0000000006750000-0x000000000679C000-memory.dmp

Download

memory/5548-126-0x0000000007AE0000-0x0000000007AEA000-memory.dmp

Download

memory/5548-125-0x0000000007A70000-0x0000000007A8A000-memory.dmp

Download

memory/5548-124-0x00000000080B0000-0x000000000872C000-memory.dmp

Download

memory/5548-110-0x00000000061C0000-0x0000000006226000-memory.dmp

Download

memory/5548-122-0x00000000078F0000-0x0000000007910000-memory.dmp

Download

memory/5548-119-0x000000006F760000-0x000000006F7AC000-memory.dmp

Download

memory/5548-118-0x00000000078B0000-0x00000000078E6000-memory.dmp

Download

memory/5548-127-0x0000000007CE0000-0x0000000007D76000-memory.dmp

Download

memory/5548-83-0x00000000031F0000-0x0000000003226000-memory.dmp

Download

memory/5548-84-0x00000000058E0000-0x0000000005F2A000-memory.dmp

Download

memory/5548-116-0x0000000006700000-0x000000000671E000-memory.dmp

Download

memory/5548-114-0x0000000006310000-0x000000000666B000-memory.dmp

Download

memory/5548-130-0x0000000007C60000-0x0000000007C71000-memory.dmp

Download

memory/5548-108-0x0000000006080000-0x00000000060A2000-memory.dmp

Download

memory/5548-109-0x0000000006150000-0x00000000061B6000-memory.dmp

Download

memory/5604-41-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-128-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-86-0x0000000005720000-0x0000000005762000-memory.dmp

Download

memory/5604-85-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-71-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-70-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-60-0x0000000010000000-0x0000000010034000-memory.dmp

Download

memory/5604-59-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-57-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-58-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-42-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-43-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/5604-53-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-107-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-129-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-40-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-39-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-37-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-146-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-38-0x0000000003F00000-0x0000000003F46000-memory.dmp

Download

memory/5604-36-0x0000000003EC0000-0x0000000003EFF000-memory.dmp

Download

memory/5804-140-0x0000000007330000-0x00000000073D3000-memory.dmp

Download

memory/5804-141-0x0000000007660000-0x0000000007671000-memory.dmp

Download

memory/5804-137-0x000000006F9E0000-0x000000006FA2C000-memory.dmp

Download

memory/5804-135-0x0000000006430000-0x000000000647C000-memory.dmp

Download