Analysis
- max time kernel
300s - max time network
293s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ជ្រើសរើសបុគ្គលិកបន្ទាន់។ តម្រូវការការងារ។doc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
ជ្រើសរើសបុគ្គលិកបន្ទាន់។ តម្រូវការការងារ។doc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
300 seconds
General
- Target ជ្រើសរើសបុគ្គលិកបន្ទាន់។ តម្រូវការការងារ។doc.exe
- Size 3.7MB
- Sample260816-ceasqabm2x
- SHA256 aadce1306e8740ca09fe43f74ed9059496bbde9d13f86528d2ffce260fa2af4a
- MD5 09d35b41419e795ce4ac0539da4df89b
- SHA1 5ad01ed03fbaae61d5d80a5d06795dc9aa00e61d
- SHA512 d4ff547e7321f84d0e67fd011215bdfc0f264b6c198d066dcbd2b180d5892106eb5092eff979325d7b6c48cab887d41087977c55998a17680125df308c33797c
- SSDEEP 98304:C3G06DIFD0YC9NgM/qBMqnRkNL7JqL2/4D4J:C3GZ817Cc8qnRkNSDo
- TLSH T164062309EBA809F4E4A7D578D9974C1BE77A3C4E4370D69F13A5426A1F2B3A0DE39310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/memory/4492-73-0x00000000026F0000-0x000000000273A000-memory.dmp family_donutloader - Detects ValleyRAT payload 2 IoCs
resource yara_rule behavioral2/memory/4492-73-0x00000000026F0000-0x000000000273A000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4492-75-0x00000000028D0000-0x000000000291F000-memory.dmp family_valleyrat_stage_2_v2 - Executes dropped EXE 2 IoCs
pid Process 4272 TGFile.exe 4492 TGFile.exe - Loads dropped DLL 8 IoCs
pid Process 4272 TGFile.exe 4272 TGFile.exe 4272 TGFile.exe 4272 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: TGFile.exe File opened (read-only) \??\S: TGFile.exe File opened (read-only) \??\U: TGFile.exe File opened (read-only) \??\W: TGFile.exe File opened (read-only) \??\Y: TGFile.exe File opened (read-only) \??\M: TGFile.exe File opened (read-only) \??\T: TGFile.exe File opened (read-only) \??\Z: TGFile.exe File opened (read-only) \??\G: TGFile.exe File opened (read-only) \??\R: TGFile.exe File opened (read-only) \??\X: TGFile.exe File opened (read-only) \??\B: TGFile.exe File opened (read-only) \??\D: TGFile.exe File opened (read-only) \??\H: TGFile.exe File opened (read-only) \??\I: TGFile.exe File opened (read-only) \??\K: TGFile.exe File opened (read-only) \??\O: TGFile.exe File opened (read-only) \??\Q: TGFile.exe File opened (read-only) \??\V: TGFile.exe File opened (read-only) \??\J: TGFile.exe File opened (read-only) \??\L: TGFile.exe File opened (read-only) \??\N: TGFile.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1360 cmd.exe - Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64\ = "script:C:\\ProgramLog\\Windows\\AppData\\Log\\log.s" TGFile.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64 TGFile.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib TGFile.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} TGFile.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1 TGFile.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0 TGFile.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe 4492 TGFile.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4492 TGFile.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4272 3124 ជ្រើសរើសបុគ្គលិកបន្ទាន់។ តម្រូវការការងារ។doc.exe 88 PID 4272 wrote to memory of 1360 4272 TGFile.exe 91 PID 1360 wrote to memory of 4492 1360 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\ជ្រើសរើសបុគ្គលិកបន្ទាន់។ តម្រូវការការងារ។doc.exe"C:\Users\Admin\AppData\Local\Temp\ជ្រើសរើសបុគ្គលិកបន្ទាន់។ តម្រូវការការងារ។doc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\ProgramLog\Windows\AppData\Log\TGFile.exe"C:\ProgramLog\Windows\AppData\Log\TGFile.exe" 1.txt2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c cd /d "C:\ProgramLog\Windows\AppData\Log\" && "C:\ProgramLog\Windows\AppData\Log\TGFile.exe" hide.log3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\ProgramLog\Windows\AppData\Log\TGFile.exe"C:\ProgramLog\Windows\AppData\Log\TGFile.exe" hide.log4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4492
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramLog\Windows\AppData\Log\1.txt
- Size 3KB
- SHA256 b2c734974cb18d2d0a390e7e854c3ec883e30773b7fcae41ef1a6e299888ff93
- MD5 22c8009ca3c08e844ec2f44d90ff5ee5
- SHA1 ea39457cf74c1458a968b9bc8d558b4173d232ac
- SHA512 e4e9e7508bb00bb0e8fd58ca3dcea9f10cbe8e0146ed4d27becc6fd40425903456d340fd835ee1671a01989978dc98e8a9582f2a6ed873a89fa72598b72c7afb
- TLSH T13C615309D4CA03D7F6732137094A76A54A8F66072E39EF20388FA3426F4E24DD575AD7
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramLog\Windows\AppData\Log\MSVCR100.dll
- Size 809KB
- SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
- MD5 df3ca8d16bded6a54977b30e66864d33
- SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
- SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
- SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
- TLSH T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Log\TGFile.exe
- Size 27KB
- SHA256 09cd30b1b25da3ff6661be589d5c31460e51e9ee8e7925df37826456bb8da2bc
- MD5 f1e0d6013f5117046c1b1a048166d225
- SHA1 96bd05457588618be0494ec32c58113443d61459
- SHA512 7544dc4ead8dd9e6b58ab79da62e89afc3c98b73c1562c9053bacbe600b08f4457fbd22f01d7e127960c0d0b4ba5cd8dc375e33f25d4044fc8969c2761b925e8
- SSDEEP 384:TU0xnb4moWtuXDSaa0RXDvuSOf050DcZIYiOJ0Pi/ay8RbmL4nNyNa:RxnbvVu2KRXD2SOMOLYibP6a5ALq
- TLSH T163C28E6A4B651899D617E038F0901617E9B0B2721BA091EF7308CB948F533D3BFBE316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Log\hide.log
- Size 3KB
- SHA256 35ba902dc0670f96a9c398466ae8f66eb148b36b29286e60d49bb283909a9200
- MD5 183a0ae95b84f3240bd25a6af148a6f5
- SHA1 b1f6755aadda7e8406f43bbc2b5335934857a19b
- SHA512 fab5ec52477c7a9eeedbefa433f2740544541654ee0ec9d78c7475ec742c0a96c11c33ac1c1209598eaedb2cecfe6dd85ec19e9620d6eaf613bd47244118d2bd
- TLSH T12671D60991ED1B8662335AF60A4616B0B90AC52E3735EEA4315EE0582F4F21DDB293C2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramLog\Windows\AppData\Log\libepsbase.dll
- Size 262KB
- SHA256 5a2fdc4111ce15f24e9283eb6b135046fdf47b14b193646b61798b72ce3c687c
- MD5 11341b8b8c20a2c3a7f2d3b80899cd0f
- SHA1 b27f270209693de75071003a4a60795bb224688d
- SHA512 9ca1e79949f6c1960ee2cc25a8b8014e6433b9bf6d852600c31cc2c200f7d7d3b679c57b51b24265a1a94f287f201402c66a3f1eabc8c822430150a08dfdf448
- SSDEEP 6144:rVNcb9gwAGl+qDW/lBy5N5PZX9V50DErkkysOYOQE:DcblAGl+D/lB1DBNsOtZ
- TLSH T187449E5AB2640CE8E637B079C566C207F2F27C1D8390E7DF4A60A5541773AE2727D782
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Log\lua51.dll
- Size 476KB
- SHA256 355e34c71f6b3178092862529382566088aa80abeba67eb09fdf47852889b612
- MD5 09a36334668b5891b1a627e5e8b8203a
- SHA1 bfc2eb1d84bd250cc0f8e86e0553d0f89bf1ae8b
- SHA512 fef60f7e8b6a608587de20b931fc0f23c5c090a01d8dc98a33f55235798936db3e72edf42e7429be90d51fc4a9370d1ac8a21cc50e4aac661f4ce15b8798881e
- SSDEEP 6144:qrPB2x/Z4epBQFAPLVV+iJP/z3qGTR8LPfiK7WBOrqVt/GnNcjnudD1CpZUqWe72:ZDBA+2XiKaB9Ge997L1DCr+kBV8s
- TLSH T1D7A45B49E6740669C5AB807889535D0FD3B6384507A09BDF07E4BBA72B33FD9263B324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Log\pip.exe
- Size 100KB
- SHA256 4110a46b19b43f63bf48859c1c0902494f51fa68ebeb176f0ea7e7c79377d877
- MD5 e24b5d7b634ed61e46d63005cd804325
- SHA1 024cdba4ecf7457695cf66474135d440b205811b
- SHA512 0aa2fa4d5743c97ff5f71dc1371359f413d748fdc13b4bb6ab8cd032deabe99ea1cd48cb1b0bcf129c2bfa5883b011be9da4096a6e47d3c438b0d6e0a2ff04a3
- SSDEEP 3072:QVUcdPuPHfEjETjPNtSweAhPXjSvZmXHlfHYTo4X:eBUPHfAETTNt2ApzXFgTL
- TLSH T195A37C8633D450FAD4269274CCA3C915D3B2FC674675834F27A47B6A2F333925D2AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Log\set.log
- Size 295KB
- SHA256 6c4bd944b95f652cb1cd8cdea6fd18001982f170f2b279657ca7154e0fbbef5e
- MD5 8264144ad959192fc74c7fdd5c3a149c
- SHA1 26917501e80d7e0406ecbdaf9f23c90a059748e6
- SHA512 7fee1a9aa5867a13cceb926c5a502eb9ecf8c937754fa9c5399637b48de6a0bba7969f5004794c9ef42adc1cd80addcdc30faa1001be9a7ff6746c8e9a7af508
- SSDEEP 6144:h4tMgGLro4mSSRNoYpvPebXsrQW3ChYlf5sIrPUgHRgbmeqrLjkkb:qtRh4mSgoYZPZrQWZsIPUggmx7B
- TLSH T1455423F798281973B35BF8DFE4D65C4A8D988607F1161F6B6F4BB085D03EB52A324224
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramLog\Windows\AppData\Log\vcruntime140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH