valleyrat_s2 | de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4

Analysis

max time kernel
77s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Open_to_view.exe
Size 25KB
Sample260819-ldlchaeb98
SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
MD5 e6363b8ec386338ce08f159a739f0e97
SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
TLSH
T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

207.56.119.83:6666

Attributes

campaign_date
2026-08-16

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 9 IoCs

resource	yara_rule
behavioral2/memory/2000-11-0x00000000049A0000-0x00000000049FF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4372-75-0x0000000002000000-0x000000000205F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3340-117-0x00000000008E0000-0x000000000093F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3888-159-0x0000000001140000-0x000000000119F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3888-160-0x0000000001140000-0x000000000119F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4432-201-0x0000000000FE0000-0x000000000103F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4432-202-0x0000000000FE0000-0x000000000103F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2824-243-0x0000000002110000-0x000000000216F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2824-244-0x0000000002110000-0x000000000216F000-memory.dmp	family_valleyrat_stage_2_v2

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1956	powershell.exe
5288	powershell.exe
4712	powershell.exe
2072	powershell.exe
2640	powershell.exe
596	powershell.exe
3928	powershell.exe
2664	powershell.exe
1152	powershell.exe
3556	powershell.exe
3144	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe

Executes dropped EXE 5 IoCs

pid	Process
4288	cvlxuy45.exe
1304	jl6y4t5n.exe
4108	zfo1ouk6.exe
5348	tukz4exx.exe
5012	584c7p7v.exe

Loads dropped DLL 5 IoCs

pid	Process
4288	cvlxuy45.exe
1304	jl6y4t5n.exe
4108	zfo1ouk6.exe
5348	tukz4exx.exe
5012	584c7p7v.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4852	Open_to_view.exe
4852	Open_to_view.exe
4852	Open_to_view.exe
4852	Open_to_view.exe
4852	Open_to_view.exe
4852	Open_to_view.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2000	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeIncreaseQuotaPrivilege	4712	powershell.exe
Token: SeSecurityPrivilege	4712	powershell.exe
Token: SeTakeOwnershipPrivilege	4712	powershell.exe
Token: SeLoadDriverPrivilege	4712	powershell.exe
Token: SeSystemProfilePrivilege	4712	powershell.exe
Token: SeSystemtimePrivilege	4712	powershell.exe
Token: SeProfSingleProcessPrivilege	4712	powershell.exe
Token: SeIncBasePriorityPrivilege	4712	powershell.exe
Token: SeCreatePagefilePrivilege	4712	powershell.exe
Token: SeBackupPrivilege	4712	powershell.exe
Token: SeRestorePrivilege	4712	powershell.exe
Token: SeShutdownPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeSystemEnvironmentPrivilege	4712	powershell.exe
Token: SeRemoteShutdownPrivilege	4712	powershell.exe
Token: SeUndockPrivilege	4712	powershell.exe
Token: SeManageVolumePrivilege	4712	powershell.exe
Token: 33	4712	powershell.exe
Token: 34	4712	powershell.exe
Token: 35	4712	powershell.exe
Token: 36	4712	powershell.exe
Token: SeIncreaseQuotaPrivilege	4712	powershell.exe
Token: SeSecurityPrivilege	4712	powershell.exe
Token: SeTakeOwnershipPrivilege	4712	powershell.exe
Token: SeLoadDriverPrivilege	4712	powershell.exe
Token: SeSystemProfilePrivilege	4712	powershell.exe
Token: SeSystemtimePrivilege	4712	powershell.exe
Token: SeProfSingleProcessPrivilege	4712	powershell.exe
Token: SeIncBasePriorityPrivilege	4712	powershell.exe
Token: SeCreatePagefilePrivilege	4712	powershell.exe
Token: SeBackupPrivilege	4712	powershell.exe
Token: SeRestorePrivilege	4712	powershell.exe
Token: SeShutdownPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeSystemEnvironmentPrivilege	4712	powershell.exe
Token: SeRemoteShutdownPrivilege	4712	powershell.exe
Token: SeUndockPrivilege	4712	powershell.exe
Token: SeManageVolumePrivilege	4712	powershell.exe
Token: 33	4712	powershell.exe
Token: 34	4712	powershell.exe
Token: 35	4712	powershell.exe
Token: 36	4712	powershell.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeIncreaseQuotaPrivilege	2072	powershell.exe
Token: SeSecurityPrivilege	2072	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	explorer.exe
4372	explorer.exe
3340	explorer.exe
3888	explorer.exe
4432	explorer.exe
2824	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2000	4852	Open_to_view.exe	81
PID 2000 wrote to memory of 1740	2000	explorer.exe
PID 4288 wrote to memory of 4712	4288	cvlxuy45.exe	92
PID 4288 wrote to memory of 4372	4288	cvlxuy45.exe	95
PID 4288 wrote to memory of 4372	4288	cvlxuy45.exe	95
PID 2000 wrote to memory of 5568	2000	explorer.exe
PID 1304 wrote to memory of 2072	1304	jl6y4t5n.exe	99
PID 1304 wrote to memory of 3340	1304	jl6y4t5n.exe	101
PID 1304 wrote to memory of 3340	1304	jl6y4t5n.exe	101
PID 2000 wrote to memory of 5396	2000	explorer.exe
PID 4108 wrote to memory of 3556	4108	zfo1ouk6.exe	104
PID 4108 wrote to memory of 3888	4108	zfo1ouk6.exe	106
PID 4108 wrote to memory of 3888	4108	zfo1ouk6.exe	106
PID 2000 wrote to memory of 1464	2000	explorer.exe
PID 5348 wrote to memory of 3144	5348	tukz4exx.exe	109
PID 5348 wrote to memory of 4432	5348	tukz4exx.exe	111
PID 5348 wrote to memory of 4432	5348	tukz4exx.exe	111
PID 2000 wrote to memory of 5576	2000	explorer.exe
PID 5012 wrote to memory of 2640	5012	584c7p7v.exe	114
PID 5012 wrote to memory of 2824	5012	584c7p7v.exe	116
PID 5012 wrote to memory of 2824	5012	584c7p7v.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Windows security bypass
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe
  "C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4852

C:\ProgramData\EdgeUpdate\fl967opj\cvlxuy45.exe
C:\ProgramData\EdgeUpdate\fl967opj\cvlxuy45.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4372

C:\ProgramData\EdgeUpdate\pbc4irwk\jl6y4t5n.exe
C:\ProgramData\EdgeUpdate\pbc4irwk\jl6y4t5n.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3340

C:\ProgramData\EdgeUpdate\7y3b2nl7\zfo1ouk6.exe
C:\ProgramData\EdgeUpdate\7y3b2nl7\zfo1ouk6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3556
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3888

C:\ProgramData\EdgeUpdate\c266og8w\tukz4exx.exe
C:\ProgramData\EdgeUpdate\c266og8w\tukz4exx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3144
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4432

C:\ProgramData\EdgeUpdate\f5f5yi2f\584c7p7v.exe
C:\ProgramData\EdgeUpdate\f5f5yi2f\584c7p7v.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2640
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:2824

C:\ProgramData\EdgeUpdate\czo98dqm\cjbec3x2.exe
C:\ProgramData\EdgeUpdate\czo98dqm\cjbec3x2.exe
1⤵
PID:5932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1956
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1744

C:\ProgramData\EdgeUpdate\9qdw7dxx\5jtnpnj5.exe
C:\ProgramData\EdgeUpdate\9qdw7dxx\5jtnpnj5.exe
1⤵
PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:596
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5736

C:\ProgramData\EdgeUpdate\9dem5edm\aqu4699x.exe
C:\ProgramData\EdgeUpdate\9dem5edm\aqu4699x.exe
1⤵
PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3928
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6120

C:\ProgramData\EdgeUpdate\u51wu61s\cmd50fj8.exe
C:\ProgramData\EdgeUpdate\u51wu61s\cmd50fj8.exe
1⤵
PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2664
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2332

C:\ProgramData\EdgeUpdate\bim4az1r\l3e22u7i.exe
C:\ProgramData\EdgeUpdate\bim4az1r\l3e22u7i.exe
1⤵
PID:5788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5288
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3300

C:\ProgramData\EdgeUpdate\8pp8ac4m\9fva6kze.exe
C:\ProgramData\EdgeUpdate\8pp8ac4m\9fva6kze.exe
1⤵
PID:6016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1152
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webview_support.dll

Path C:\ProgramData\EdgeUpdate\7y3b2nl7\webview_support.dll
Size 160KB
SHA256 c742f343946f4a6ec59fb76391aa0ba31fc10afe2d3bd0d652c12a6e237976b7
MD5 eed275dfcb3f9bfa4332ae12f09c48c2
SHA1 b92cfe916bacfcf742eea1b311ca313fa31159df
SHA512 768ef1c56969936aca397ea78f1d5a41379400e2ff6d7b1752ebe60289679d5ede04b1150dd65d979b19d24fe9c8d6a9a3ee6d16a93ff508494942f7e64e7b0d
SSDEEP 3072:i0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:EDLsL1WpCTLe1wZ
TLSH
T14FF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\8pp8ac4m\webview_support.dll
Size 160KB
SHA256 82dddb2c2d02b96f1b24bd5057d09a8ef298222b5dc784fc2496fd4244c5f212
MD5 92aeec8d3f6303f901469574951d878c
SHA1 3ddd303536f7114412e2d9b7c4125e773fa64d9f
SHA512 5f05cd6bcae8c91b2cfa862038d87279b1439b7e17e3f1b80e43c30df61d8b82d254741d936eb9603eeac9b6e20b40c760563a4eb95c2756088e62f211c52a44
SSDEEP 3072:I0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:6DLsL1WpCTLe1wZ
TLSH
T142F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\9dem5edm\webview_support.dll
Size 160KB
SHA256 94aac79e834d689dd25f37f7cd10442554312a9f60964b3ad29125b0c6ba0b50
MD5 8c4ba108642a0cea55a0a0536978ed97
SHA1 e0904a7c2f521c4db58769d07a5807d3d9479556
SHA512 14133be77b4406bac52c4e9f751c18e414bf145c0a02ff98f48264a94be7af270eac51e83d7a38043d9d5a855aeddab9fe9aeb9cfae5d5901809450325d1d4ce
SSDEEP 3072:q0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:MDLsL1WpCTLe1wZ
TLSH
T1F8F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\9qdw7dxx\webview_support.dll
Size 160KB
SHA256 b709e35ca4c0b45a4a1097bb3d4d8b28b27413f23ee14381025743fa3ae3dfc0
MD5 0ae6afa3342ea9b5481e37c4ffaf3599
SHA1 34958911349661b449cf416021569f6ce03d026f
SHA512 9df25d5b0ffd60cf8ffaae9d211738102902979b30042a6c61127139d701ccc75b81e58c894f4b0ed4551f04e6baa5e7582ca479c371a92c8530e639f2f59c92
SSDEEP 3072:O0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:4DLsL1WpCTLe1wZ
TLSH
T132F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\bim4az1r\webview_support.dll
Size 160KB
SHA256 756e6712292348f8110db9cbcacaec2565ea02efd706e9450f78bbe655da52d2
MD5 41ef0afa6c3a34d0e0fee0b32f9eb4e5
SHA1 86ddb5a84a0b994cf483df8ccf0e00a7465f1bea
SHA512 7efc62a8370609e116cc8c44ebe3a094b2e66c79ba1a3315e1bed780d6380d1c8688648fc819d60e2ba6c29f8d8c83cad6c43d7b243b020d02385d6046903925
SSDEEP 3072:C0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:kDLsL1WpCTLe1wZ
TLSH
T1BDF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\c266og8w\webview_support.dll
Size 160KB
SHA256 ff3b501a2de2d332609f436fdeaa24dc4ed7643f4c0d14cb019f5d33a33a2ccb
MD5 01b066921855755dbfc1b7dde465c79d
SHA1 907836b6b0e36ae64630c8eb8935e4f8727b6308
SHA512 6edbafdacc2e6f7bff83ef4fa9427019350017e7933e0d4922e12053a150a36b8a7b9e2a48c848653716710e42ea897e2c21cb948d48dc02fa0aead21116922f
SSDEEP 3072:N0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:7DLsL1WpCTLe1wZ
TLSH
T178F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\czo98dqm\webview_support.dll
Size 160KB
SHA256 efcf644e9667d9934b06c2926c73d976d856d7af296b319e69a78ac095b831c9
MD5 cb69ee2d845aa2968f7f79fbd7822c62
SHA1 764e1a18c01d56a8f7b19ace525cd29e0bd9d3b9
SHA512 9b6d6aef7f2626a9e7acfa3b30867e3814a2216f3c7b58eabf156738728511b6a95c85bab0aa50959bdf15174af1478be204297d172dba691abb72b05fea30a8
SSDEEP 3072:Y0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:qDLsL1WpCTLe1wZ
TLSH
T12EF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\f5f5yi2f\webview_support.dll
Size 160KB
SHA256 2f92e3d2a062ce9a20a84eb7f74664726136c93a8977b493eada310c20a7e91a
MD5 dcb51d91ddfc6d99b3fed9daea61c36e
SHA1 51435a7a10d71189483fb1caa1728ef4b1ea65ed
SHA512 ec06b0c1ccec2f6f6f6cb64a4aaba6364476f55f3d8eac8f10d0bee2c7d86cd174d5369b2c520cc9476af4ce66a3d0a620073eb16be577659c4471d4940ef2b2
SSDEEP 3072:t0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:bDLsL1WpCTLe1wZ
TLSH
T19DF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.log

Path C:\ProgramData\EdgeUpdate\fl967opj\config.log
Size 350KB
SHA256 b71dd8099864e9a3b17ccae293d14f701951ec4717076f8d8deb079e1735638d
MD5 6ecb3a50a8cfeb9d6c2cd16a6bc2e21d
SHA1 e8b6dae0a33fa636aa8fa3741926c3a7987cccc7
SHA512 4db965502c886103dc651de3e01e9eccfe30bff3eb1a2b52abea002bcdc1989c3c1ed742aef21dcae979a1cbe55087903529204c0c994bc34436d5b6778788e1
SSDEEP 6144:7cGTZggC8heawvACKE3HsZarWJ64UOl0p0TaZlY4ORh73iTl:I6ZwvAkHsZI7PK0DZu5g
TLSH
T145746C15E7A504A9F277C178C9638916EB767C4603A0EAEF13B049993F33FE0663A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cvlxuy45.exe

Path C:\ProgramData\EdgeUpdate\fl967opj\cvlxuy45.exe
Size 350KB
SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
MD5 4fc050633f860b43e66f4a43b06795b7
SHA1 128533b22c908239f6aa22486fbf66ac8fc9822f
SHA512 cc2e6871fe9e5db154923c57ea161ad265af268346d35f59e4490e93b30940a0105a9725e7c2ffbd9bf826109a8e09313f48a0ff58fd7fe0447a4644ce42babc
SSDEEP 6144:HLvQi6Lx4OtdU2eA37Z1/UoInhMho9guvV99nL:HzQRxleArZ1shukfnL
TLSH
T1BD742719BE6448E5F966A2FC8A758F4AE6717C150B21D7CF0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\fl967opj\webview_support.dll
Size 160KB
SHA256 b4d6394670720a2494ccee9eb7ad71a50534eb7516a2ec3630291a7665358256
MD5 416a669132858b456e3d656d51bfc0bf
SHA1 1c996d98161246767e5f361e36636b73f2244c88
SHA512 5e4eed22badcfcaa7e38d40a5de1c4cd90729a7c38e354c1be2c694d0841385080373558296e5b157eaa85d51a0027067f98f619a47d27032b436cf7db5e46a4
SSDEEP 3072:w0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:CDLsL1WpCTLe1wZ
TLSH
T143F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\pbc4irwk\webview_support.dll
Size 160KB
SHA256 8d613bb41a71245b10c3e1a8f0ca089fb545b2daa9c34100cb4eeb331dad9ff5
MD5 8966127d9cef30d5ede5882af56f31c0
SHA1 4ebe99db60bf24315a494f3b8359f9ca22260ed7
SHA512 833275a477bf3f1689166fc53c31873a39cb35b82549c213068711fcc596ba9e765c088efec83690df3d5875ed7018e2b0ebe1d5a6ec6830f23d6e9f2a3cd05c
SSDEEP 3072:C0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:kDLsL1WpCTLe1wZ
TLSH
T170F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\u51wu61s\webview_support.dll
Size 160KB
SHA256 88b5d1b32ead19064fc716c3720658de999612b18da70ffae3c476a335c31b4c
MD5 1211cc15fd710466a2a42157747c7141
SHA1 a028c6ad1d2e1e0035aeba64513ef5af423eff99
SHA512 780ed2af8b82b004770534f582673d2914606cd6828c012d606a7dbb6dd9f126692927e5611132bd44fe7110f9838454fc27f1d74d42253d6047a5564d4244a5
SSDEEP 3072:40yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:KDLsL1WpCTLe1wZ
TLSH
T14EF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download