Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 04:19
Behavioral task
behavioral1
Sample
2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample260816-exycvazblb
- SHA256 dfaf951132886784c873209f7e0e813a830eb4bee7ad14308f4066157613cce5
- MD5 727ea1c29ab73f6af06c358b25250ce3
- SHA1 cd8c10ed3d0eb145b39aef775a04d6c6a366a533
- SHA512 0b9e0393daeb25ff7efcc71554da2369e59b39cdaa5951f2328c87d52b8cfc3c03a737b300baa6bd8831c79a65eacee944179742e2716196935ef3c9e364070b
- SSDEEP 3072:m4jPfhWV9XBb0MAtrg0OoHpFcNTXT2pTnbR1g2br54Qun9UItLpCEcbqGpYl7WUB:m4jUXB0MZDoJFcp0/gI6QkUIcbpO5zx
- TLSH T149548C2175E0C032D1AA153A0874DB665F3FBD308B659DCB77981A7E0E702C1AE3976B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 8 IoCs
resource yara_rule behavioral2/memory/1052-1-0x00000000003B0000-0x00000000003E3000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1052-2-0x0000000000B80000-0x0000000000BB9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1052-3-0x0000000000B80000-0x0000000000BB9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1052-4-0x0000000000B80000-0x0000000000BB9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1052-5-0x0000000000B80000-0x0000000000BB9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1052-10-0x0000000000B80000-0x0000000000BB9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1052-9-0x0000000000B80000-0x0000000000BB9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1052-11-0x0000000000B80000-0x0000000000BB9000-memory.dmp family_valleyrat_stage_2_v2 - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: tracerpt.exe File opened (read-only) \??\D: tracerpt.exe File opened (read-only) \??\J: tracerpt.exe File opened (read-only) \??\L: tracerpt.exe File opened (read-only) \??\T: tracerpt.exe File opened (read-only) \??\B: tracerpt.exe File opened (read-only) \??\G: tracerpt.exe File opened (read-only) \??\I: tracerpt.exe File opened (read-only) \??\Q: tracerpt.exe File opened (read-only) \??\S: tracerpt.exe File opened (read-only) \??\X: tracerpt.exe File opened (read-only) \??\Y: tracerpt.exe File opened (read-only) \??\Z: tracerpt.exe File opened (read-only) \??\R: tracerpt.exe File opened (read-only) \??\H: tracerpt.exe File opened (read-only) \??\K: tracerpt.exe File opened (read-only) \??\M: tracerpt.exe File opened (read-only) \??\N: tracerpt.exe File opened (read-only) \??\O: tracerpt.exe File opened (read-only) \??\W: tracerpt.exe File opened (read-only) \??\U: tracerpt.exe File opened (read-only) \??\V: tracerpt.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5000 set thread context of 1052 5000 2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tracerpt.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe 1052 tracerpt.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1052 tracerpt.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1052 tracerpt.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1052 tracerpt.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5000 wrote to memory of 1052 5000 2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe 89 PID 5000 wrote to memory of 1052 5000 2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe 89 PID 1052 wrote to memory of 4128 1052 tracerpt.exe 91 PID 1052 wrote to memory of 4128 1052 tracerpt.exe 91 PID 1052 wrote to memory of 4128 1052 tracerpt.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_727ea1c29ab73f6af06c358b25250ce3_amadey_cobalt-strike_elex_ghostweaver_lockbit_rhadamanthys_smoke-loader.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\tracerpt.exe"C:\Windows\SysWOW64\tracerpt.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵PID:4128
-
-