valleyrat_s2 | de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4

Analysis

user interaction
yes
max time kernel
64s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Open_to_view.exe
Size 25KB
Sample260819-c2nm4avfpd
SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
MD5 e6363b8ec386338ce08f159a739f0e97
SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
TLSH
T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

207.56.119.83:6666

Attributes

campaign_date
2026-08-16

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 9 IoCs

resource	yara_rule
behavioral2/memory/4656-11-0x0000000003CC0000-0x0000000003D1F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2752-77-0x0000000001740000-0x000000000179F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2752-78-0x0000000001740000-0x000000000179F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1100-120-0x00000000014F0000-0x000000000154F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1100-121-0x00000000014F0000-0x000000000154F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4320-162-0x0000000001070000-0x00000000010CF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4320-163-0x0000000001070000-0x00000000010CF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4344-204-0x0000000002E10000-0x0000000002E6F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/364-246-0x00000000013A0000-0x00000000013FF000-memory.dmp	family_valleyrat_stage_2_v2

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4672	powershell.exe
2832	powershell.exe
4216	powershell.exe
6000	powershell.exe
1532	powershell.exe
3928	powershell.exe
4916	powershell.exe
1984	powershell.exe
4620	powershell.exe
3836	powershell.exe
2196	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
4132	566tko42.exe
1132	d1o7n6bf.exe
1312	49y22842.exe
5848	hds1ym4r.exe

Loads dropped DLL 4 IoCs

pid	Process
4132	566tko42.exe
1132	d1o7n6bf.exe
1312	49y22842.exe
5848	hds1ym4r.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	Open_to_view.exe
4676	Open_to_view.exe
4676	Open_to_view.exe
4676	Open_to_view.exe
4676	Open_to_view.exe
4676	Open_to_view.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4656	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeIncreaseQuotaPrivilege	4216	powershell.exe
Token: SeSecurityPrivilege	4216	powershell.exe
Token: SeTakeOwnershipPrivilege	4216	powershell.exe
Token: SeLoadDriverPrivilege	4216	powershell.exe
Token: SeSystemProfilePrivilege	4216	powershell.exe
Token: SeSystemtimePrivilege	4216	powershell.exe
Token: SeProfSingleProcessPrivilege	4216	powershell.exe
Token: SeIncBasePriorityPrivilege	4216	powershell.exe
Token: SeCreatePagefilePrivilege	4216	powershell.exe
Token: SeBackupPrivilege	4216	powershell.exe
Token: SeRestorePrivilege	4216	powershell.exe
Token: SeShutdownPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeSystemEnvironmentPrivilege	4216	powershell.exe
Token: SeRemoteShutdownPrivilege	4216	powershell.exe
Token: SeUndockPrivilege	4216	powershell.exe
Token: SeManageVolumePrivilege	4216	powershell.exe
Token: 33	4216	powershell.exe
Token: 34	4216	powershell.exe
Token: 35	4216	powershell.exe
Token: 36	4216	powershell.exe
Token: SeIncreaseQuotaPrivilege	4216	powershell.exe
Token: SeSecurityPrivilege	4216	powershell.exe
Token: SeTakeOwnershipPrivilege	4216	powershell.exe
Token: SeLoadDriverPrivilege	4216	powershell.exe
Token: SeSystemProfilePrivilege	4216	powershell.exe
Token: SeSystemtimePrivilege	4216	powershell.exe
Token: SeProfSingleProcessPrivilege	4216	powershell.exe
Token: SeIncBasePriorityPrivilege	4216	powershell.exe
Token: SeCreatePagefilePrivilege	4216	powershell.exe
Token: SeBackupPrivilege	4216	powershell.exe
Token: SeRestorePrivilege	4216	powershell.exe
Token: SeShutdownPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeSystemEnvironmentPrivilege	4216	powershell.exe
Token: SeRemoteShutdownPrivilege	4216	powershell.exe
Token: SeUndockPrivilege	4216	powershell.exe
Token: SeManageVolumePrivilege	4216	powershell.exe
Token: 33	4216	powershell.exe
Token: 34	4216	powershell.exe
Token: 35	4216	powershell.exe
Token: 36	4216	powershell.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeShutdownPrivilege	4656	explorer.exe
Token: SeCreatePagefilePrivilege	4656	explorer.exe
Token: SeDebugPrivilege	4916	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4656	explorer.exe
2752	explorer.exe
1100	explorer.exe
4320	explorer.exe
4344	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4656	4676	Open_to_view.exe	80
PID 4656 wrote to memory of 5860	4656	explorer.exe
PID 4132 wrote to memory of 4216	4132	566tko42.exe	91
PID 4132 wrote to memory of 2752	4132	566tko42.exe	94
PID 4132 wrote to memory of 2752	4132	566tko42.exe	94
PID 4656 wrote to memory of 5816	4656	explorer.exe
PID 1132 wrote to memory of 4916	1132	d1o7n6bf.exe	98
PID 1132 wrote to memory of 1100	1132	d1o7n6bf.exe	100
PID 1132 wrote to memory of 1100	1132	d1o7n6bf.exe	100
PID 4656 wrote to memory of 2924	4656	explorer.exe
PID 1312 wrote to memory of 1984	1312	49y22842.exe	103
PID 1312 wrote to memory of 4320	1312	49y22842.exe	105
PID 1312 wrote to memory of 4320	1312	49y22842.exe	105
PID 4656 wrote to memory of 5892	4656	explorer.exe
PID 5848 wrote to memory of 4620	5848	hds1ym4r.exe	108
PID 5848 wrote to memory of 4344	5848	hds1ym4r.exe	110
PID 5848 wrote to memory of 4344	5848	hds1ym4r.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe
  "C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4676

C:\ProgramData\EdgeUpdate\44t6r3tm\566tko42.exe
C:\ProgramData\EdgeUpdate\44t6r3tm\566tko42.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:2752

C:\ProgramData\EdgeUpdate\57mqrekd\d1o7n6bf.exe
C:\ProgramData\EdgeUpdate\57mqrekd\d1o7n6bf.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:1100

C:\ProgramData\EdgeUpdate\8u2gxdi3\49y22842.exe
C:\ProgramData\EdgeUpdate\8u2gxdi3\49y22842.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1984
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4320

C:\ProgramData\EdgeUpdate\zj61hvjy\hds1ym4r.exe
C:\ProgramData\EdgeUpdate\zj61hvjy\hds1ym4r.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4620
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4344

C:\ProgramData\EdgeUpdate\8weyrl5i\naqefdt3.exe
C:\ProgramData\EdgeUpdate\8weyrl5i\naqefdt3.exe
1⤵
PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6000
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:364

C:\ProgramData\EdgeUpdate\wbul9vn1\anubodck.exe
C:\ProgramData\EdgeUpdate\wbul9vn1\anubodck.exe
1⤵
PID:3212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3836
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3020

C:\ProgramData\EdgeUpdate\2ssfkho9\u19m7qpu.exe
C:\ProgramData\EdgeUpdate\2ssfkho9\u19m7qpu.exe
1⤵
PID:4020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1532
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:460

C:\ProgramData\EdgeUpdate\b9si6ccp\a8vfg1db.exe
C:\ProgramData\EdgeUpdate\b9si6ccp\a8vfg1db.exe
1⤵
PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3928
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4284

C:\ProgramData\EdgeUpdate\edny5eek\4axfw3xk.exe
C:\ProgramData\EdgeUpdate\edny5eek\4axfw3xk.exe
1⤵
PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2196
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5456

C:\ProgramData\EdgeUpdate\19ed77cf\6zbtepsn.exe
C:\ProgramData\EdgeUpdate\19ed77cf\6zbtepsn.exe
1⤵
PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4672
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4648

C:\ProgramData\EdgeUpdate\4b192mk4\nac5z1xr.exe
C:\ProgramData\EdgeUpdate\4b192mk4\nac5z1xr.exe
1⤵
PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2832
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webview_support.dll

Path C:\ProgramData\EdgeUpdate\19ed77cf\webview_support.dll
Size 160KB
SHA256 67bb69642e7d05bcda65a74ea18a9e164c5c9a1db59bfe1373eda14bbe52e605
MD5 d9d3e00147ca40846de7457e95d84230
SHA1 84cfce05a58666915af8649b736e2f6ef2cbba7a
SHA512 b62a9fcc7b548fe96cb3d4a5efc295fdbb8934cf2c0078f633754c6ebc7cd05d78dea5ab9ded18f417d4e6b7d31f52ae036f954d7b97485fb322cee70c572e62
SSDEEP 3072:y0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:0DLsL1WpCTLe1wZ
TLSH
T183F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\2ssfkho9\webview_support.dll
Size 160KB
SHA256 9d16befc78793171af33f01c3c9272229a78611d161710c562fb10c0a60a1a4b
MD5 4105271c3568afbe5a7ee4d34efa0873
SHA1 8f79062ea997a987a930cddef789d1ff2fefcbd2
SHA512 ed9348fe4c1b5403866f0f7ffad8031e4c6a8cf4e360e016b44ce77b34698de445555d783104e57aa6c2460d492371f2cb3a5fdbbd65010ead36ec59d9648622
SSDEEP 3072:a0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:cDLsL1WpCTLe1wZ
TLSH
T15BF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

566tko42.exe

Path C:\ProgramData\EdgeUpdate\44t6r3tm\566tko42.exe
Size 350KB
SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
MD5 4fc050633f860b43e66f4a43b06795b7
SHA1 128533b22c908239f6aa22486fbf66ac8fc9822f
SHA512 cc2e6871fe9e5db154923c57ea161ad265af268346d35f59e4490e93b30940a0105a9725e7c2ffbd9bf826109a8e09313f48a0ff58fd7fe0447a4644ce42babc
SSDEEP 6144:HLvQi6Lx4OtdU2eA37Z1/UoInhMho9guvV99nL:HzQRxleArZ1shukfnL
TLSH
T1BD742719BE6448E5F966A2FC8A758F4AE6717C150B21D7CF0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.log

Path C:\ProgramData\EdgeUpdate\44t6r3tm\config.log
Size 350KB
SHA256 b71dd8099864e9a3b17ccae293d14f701951ec4717076f8d8deb079e1735638d
MD5 6ecb3a50a8cfeb9d6c2cd16a6bc2e21d
SHA1 e8b6dae0a33fa636aa8fa3741926c3a7987cccc7
SHA512 4db965502c886103dc651de3e01e9eccfe30bff3eb1a2b52abea002bcdc1989c3c1ed742aef21dcae979a1cbe55087903529204c0c994bc34436d5b6778788e1
SSDEEP 6144:7cGTZggC8heawvACKE3HsZarWJ64UOl0p0TaZlY4ORh73iTl:I6ZwvAkHsZI7PK0DZu5g
TLSH
T145746C15E7A504A9F277C178C9638916EB767C4603A0EAEF13B049993F33FE0663A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\44t6r3tm\webview_support.dll
Size 160KB
SHA256 b2ee4badfb2202d8edc252c93811f2dd97c64fff83f0e029fb19352c87780ac5
MD5 032bbe6b4a2022a32db271e94ecc08be
SHA1 9c1a87b4cc89a852207a707334c597d00e4cfb7f
SHA512 b0bac5bb018a1e7c9fe51794c91dbf706f5f7bb6ff24a28aaccd82685af55ae8bd8937e820c2636a32f28c490f75bbcdcaaa51bbbbcddd930ecd3c1b6b496062
SSDEEP 3072:P0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:NDLsL1WpCTLe1wZ
TLSH
T13CF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\4b192mk4\webview_support.dll
Size 160KB
SHA256 9357809fd7c2234358d528d082d9969c6e836b45d58e53a26175634bb0918743
MD5 8bd5fa4d25323c04040da2f6b524623e
SHA1 ae7f9c74a0aaacf330d96fc7864c1130f0ec18ce
SHA512 14a24522fa2b8680c379e4a81fa48fbacb3940d7a8839203e73b99af301d4d6b7a5103cb7744da6f4cf3fed812083ff74ad531aa9fda688af730e5123c2b30a9
SSDEEP 3072:X0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:VDLsL1WpCTLe1wZ
TLSH
T142F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\57mqrekd\webview_support.dll
Size 160KB
SHA256 2a5bb7ef0a5e2e38dae10ba95c1d531062798f9bd7ce6db8b50fbf54b55cad3a
MD5 b41fc13a53912a21227c8aeef0370bdc
SHA1 a61b2810905ba9fcfec6ec1432e649d970fe6074
SHA512 ed3525126a7c2e99a54b88f0c116c3972ba9181fceee978e9621bc7c2d8da588f851974b36035a09e918ab95c19611c20d0c2a6b3570742e0546ba9587ad2dbe
SSDEEP 3072:C0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:kDLsL1WpCTLe1wZ
TLSH
T1EEF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\8u2gxdi3\webview_support.dll
Size 160KB
SHA256 e96c9808d642b790d6d828dd07ae551747a5e9103dd4f71f581bcebe208eb980
MD5 e360f431ac35ed8891a04fd9699b9c86
SHA1 08e109d907ccfeaffa7a383281e94c82fe0bf131
SHA512 0af7e561341320416ff4b171fe9de3456b2f4c2373683295d35849fba6acd1c0a09fc8658fe676f698985834f41e253dc87d6ea98f4de4805f343a40832d05aa
SSDEEP 3072:x0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:HDLsL1WpCTLe1wZ
TLSH
T1EBF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\8weyrl5i\webview_support.dll
Size 160KB
SHA256 fac41c039ea7d36b746ba55f74f1da823b83a567225d5723c2f35d680ac3e1dc
MD5 2a1f76379d7901fc47f056d4e39192cb
SHA1 8b55420aa9f5220f415549b9a28215c15d3fab15
SHA512 f0f28f0dc10f31ddd6ffeb1dc247aa4c3d7a306e8ca1b1933c22d1785b36f42e262eb005b0f1a1b8b5085551544b8a486d5cc34c2debda82b0e8445279a169d2
SSDEEP 3072:g0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:SDLsL1WpCTLe1wZ
TLSH
T11FF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\b9si6ccp\webview_support.dll
Size 160KB
SHA256 b82fb1ce89c3bd77fa210c53501c8725e5bd1bc4b9cfa702d900a3ac1d420d0b
MD5 50cf365a8e7b56137e63c62522ab0875
SHA1 13dbae0d5f325932b7e8fc740564fb099ba3908e
SHA512 dc2ec376620782d70ce5c3f2d18a5bb1b3846a5240d4ae13242e7aaa33d61f6d61bfce855de97ef677410552c50da733bf75a163ac29da868ae504fb66ff2058
SSDEEP 3072:w0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:CDLsL1WpCTLe1wZ
TLSH
T12FF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\edny5eek\webview_support.dll
Size 160KB
SHA256 ccfc77a141d73cb690c4b5ebb768f5de360a9b38330f2c12ab48ce569abd6e7d
MD5 43f598e47ac88a15e1d46434fd6064b6
SHA1 20229992604caab8de356c8dc9a8041b48018deb
SHA512 a52e9f140b1c38b3c639b70ed50fa1af8cfc5d1abd01a82c4754092794ec0da28031bb8429709c1edf59e9cc775bbc821860d47f3d52f604bdd5b7a7b06e7d72
SSDEEP 3072:e0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:oDLsL1WpCTLe1wZ
TLSH
T1A8F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\wbul9vn1\webview_support.dll
Size 160KB
SHA256 12cdbab5c8fdb8c4737d91669b4e9eb51ac375bca7b43aa7ff73d631215af5db
MD5 e7accd38fab7980f29b81da01d74c106
SHA1 5ff279b532495f15c81cb52170f8d3a68564e3d2
SHA512 eda7c10eb4e8d1b073f68936d9c4c13911b38ab376953e56771a5cc4176bcebda95f7f32d7dd6b80f422c341a99c99ca6c3f38ecc123f55232a33ef4f96d50e2
SSDEEP 3072:j0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:ZDLsL1WpCTLe1wZ
TLSH
T138F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\zj61hvjy\webview_support.dll
Size 160KB
SHA256 9717ab1240cac3cfd3491e3606cc66bab1b69c2d3a5278d71cb2fcb7a19b11eb
MD5 537fa7424f71ef7e1f65835554a5e178
SHA1 9e45acf4c07c39c14e87f3a79b6f8c95f8f1c48c
SHA512 5df3cd187c561f9cc109ce072120ceff654f8569249eb956177d122a1c791e73b17a276ff317b8a71e9830c953805512b8895d465a73b32f615dadd64609d1f2
SSDEEP 3072:a0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:cDLsL1WpCTLe1wZ
TLSH
T193F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download