valleyrat_s2 | c4b4205228f54be2422d69f9d7575c69d85a6ef0775118f6ac18eaf77e4b623c

Analysis

max time kernel
63s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winhttp.dll
Size 378KB
Sample260819-ldlchaeb98
SHA256 c4b4205228f54be2422d69f9d7575c69d85a6ef0775118f6ac18eaf77e4b623c
MD5 a7b17ab646bbb624ec3ad12209e1b596
SHA1 7075f715714f5cdf609957b11195e73d39cc1ab6
SHA512 f36687dab32f563dc8f438db8c870972cc6f59a309504fd57dcc20ee4ca35a8a6ed36e13634fdc88de217997d90a1f3b88351595ec7f55482507aa3355246a0d
SSDEEP 6144:NMlT6wypodssz+UIilHukhWxxh72k8SD1amR6fN9pn0s9M6FEbu0ge:No6wy62szLICu7iL+wmAfLtxxGbu0ge
TLSH
T18684E1465B4514F8F32B8679C71E155AA0AFA0EC4F5CEDEA80C1CB4C2E934C272F69E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

207.56.119.83:6666

Attributes

campaign_date
2026-08-16

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 7 IoCs

resource	yara_rule
behavioral4/memory/2760-11-0x0000000003430000-0x000000000348F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral4/memory/5600-72-0x0000000001200000-0x000000000125F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral4/memory/3328-115-0x0000000000A90000-0x0000000000AEF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral4/memory/4168-157-0x0000000002AB0000-0x0000000002B0F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral4/memory/4496-199-0x00000000029D0000-0x0000000002A2F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral4/memory/1056-241-0x00000000024D0000-0x000000000252F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral4/memory/1056-242-0x00000000024D0000-0x000000000252F000-memory.dmp	family_valleyrat_stage_2_v2

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5056	powershell.exe
5988	powershell.exe
2440	powershell.exe
2860	powershell.exe
3380	powershell.exe
2080	powershell.exe
1060	powershell.exe
5360	powershell.exe
1216	powershell.exe
4064	powershell.exe
3712	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1416	mee8xxni.exe
1524	jopf35rz.exe
1500	379jpojo.exe
4572	45ry1mqc.exe

Loads dropped DLL 4 IoCs

pid	Process
1416	mee8xxni.exe
1524	jopf35rz.exe
1500	379jpojo.exe
4572	45ry1mqc.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5460	rundll32.exe
5460	rundll32.exe
5460	rundll32.exe
5460	rundll32.exe
5460	rundll32.exe
5460	rundll32.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe
2760	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeIncreaseQuotaPrivilege	4064	powershell.exe
Token: SeSecurityPrivilege	4064	powershell.exe
Token: SeTakeOwnershipPrivilege	4064	powershell.exe
Token: SeLoadDriverPrivilege	4064	powershell.exe
Token: SeSystemProfilePrivilege	4064	powershell.exe
Token: SeSystemtimePrivilege	4064	powershell.exe
Token: SeProfSingleProcessPrivilege	4064	powershell.exe
Token: SeIncBasePriorityPrivilege	4064	powershell.exe
Token: SeCreatePagefilePrivilege	4064	powershell.exe
Token: SeBackupPrivilege	4064	powershell.exe
Token: SeRestorePrivilege	4064	powershell.exe
Token: SeShutdownPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeSystemEnvironmentPrivilege	4064	powershell.exe
Token: SeRemoteShutdownPrivilege	4064	powershell.exe
Token: SeUndockPrivilege	4064	powershell.exe
Token: SeManageVolumePrivilege	4064	powershell.exe
Token: 33	4064	powershell.exe
Token: 34	4064	powershell.exe
Token: 35	4064	powershell.exe
Token: 36	4064	powershell.exe
Token: SeIncreaseQuotaPrivilege	4064	powershell.exe
Token: SeSecurityPrivilege	4064	powershell.exe
Token: SeTakeOwnershipPrivilege	4064	powershell.exe
Token: SeLoadDriverPrivilege	4064	powershell.exe
Token: SeSystemProfilePrivilege	4064	powershell.exe
Token: SeSystemtimePrivilege	4064	powershell.exe
Token: SeProfSingleProcessPrivilege	4064	powershell.exe
Token: SeIncBasePriorityPrivilege	4064	powershell.exe
Token: SeCreatePagefilePrivilege	4064	powershell.exe
Token: SeBackupPrivilege	4064	powershell.exe
Token: SeRestorePrivilege	4064	powershell.exe
Token: SeShutdownPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeSystemEnvironmentPrivilege	4064	powershell.exe
Token: SeRemoteShutdownPrivilege	4064	powershell.exe
Token: SeUndockPrivilege	4064	powershell.exe
Token: SeManageVolumePrivilege	4064	powershell.exe
Token: 33	4064	powershell.exe
Token: 34	4064	powershell.exe
Token: 35	4064	powershell.exe
Token: 36	4064	powershell.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeIncreaseQuotaPrivilege	3712	powershell.exe
Token: SeSecurityPrivilege	3712	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2760	explorer.exe
5600	explorer.exe
3328	explorer.exe
4168	explorer.exe
4496	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 2760	5460	rundll32.exe	81
PID 2760 wrote to memory of 4596	2760	explorer.exe
PID 1416 wrote to memory of 4064	1416	mee8xxni.exe	91
PID 1416 wrote to memory of 5600	1416	mee8xxni.exe	94
PID 1416 wrote to memory of 5600	1416	mee8xxni.exe	94
PID 2760 wrote to memory of 3448	2760	explorer.exe
PID 1524 wrote to memory of 3712	1524	jopf35rz.exe	97
PID 1524 wrote to memory of 3328	1524	jopf35rz.exe	100
PID 1524 wrote to memory of 3328	1524	jopf35rz.exe	100
PID 2760 wrote to memory of 4412	2760	explorer.exe
PID 1500 wrote to memory of 2080	1500	379jpojo.exe	103
PID 1500 wrote to memory of 4168	1500	379jpojo.exe	105
PID 1500 wrote to memory of 4168	1500	379jpojo.exe	105
PID 2760 wrote to memory of 2700	2760	explorer.exe
PID 4572 wrote to memory of 5056	4572	45ry1mqc.exe	108
PID 4572 wrote to memory of 4496	4572	45ry1mqc.exe	110
PID 4572 wrote to memory of 4496	4572	45ry1mqc.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Windows security bypass
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\winhttp.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5460

C:\ProgramData\EdgeUpdate\7bzdg32h\mee8xxni.exe
C:\ProgramData\EdgeUpdate\7bzdg32h\mee8xxni.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:5600

C:\ProgramData\EdgeUpdate\kotozkjk\jopf35rz.exe
C:\ProgramData\EdgeUpdate\kotozkjk\jopf35rz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3328

C:\ProgramData\EdgeUpdate\lyqymj8t\379jpojo.exe
C:\ProgramData\EdgeUpdate\lyqymj8t\379jpojo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2080
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4168

C:\ProgramData\EdgeUpdate\vcss9jea\45ry1mqc.exe
C:\ProgramData\EdgeUpdate\vcss9jea\45ry1mqc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5056
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4496

C:\ProgramData\EdgeUpdate\tetqojvu\guc0s4zb.exe
C:\ProgramData\EdgeUpdate\tetqojvu\guc0s4zb.exe
1⤵
PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1060
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1056

C:\ProgramData\EdgeUpdate\bwjw3ba3\yuidg2zv.exe
C:\ProgramData\EdgeUpdate\bwjw3ba3\yuidg2zv.exe
1⤵
PID:5312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5988
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3340

C:\ProgramData\EdgeUpdate\i0md4vv3\hydeoimw.exe
C:\ProgramData\EdgeUpdate\i0md4vv3\hydeoimw.exe
1⤵
PID:200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2440
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1540

C:\ProgramData\EdgeUpdate\enhgqajz\k8swlwpn.exe
C:\ProgramData\EdgeUpdate\enhgqajz\k8swlwpn.exe
1⤵
PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2860
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1252

C:\ProgramData\EdgeUpdate\fne736z6\jy24py1k.exe
C:\ProgramData\EdgeUpdate\fne736z6\jy24py1k.exe
1⤵
PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5360
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4608

C:\ProgramData\EdgeUpdate\zguawdng\57l35vn8.exe
C:\ProgramData\EdgeUpdate\zguawdng\57l35vn8.exe
1⤵
PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1216
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1144

C:\ProgramData\EdgeUpdate\nwomeody\usqgve10.exe
C:\ProgramData\EdgeUpdate\nwomeody\usqgve10.exe
1⤵
PID:256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3380
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.log

Path C:\ProgramData\EdgeUpdate\7bzdg32h\config.log
Size 350KB
SHA256 b71dd8099864e9a3b17ccae293d14f701951ec4717076f8d8deb079e1735638d
MD5 6ecb3a50a8cfeb9d6c2cd16a6bc2e21d
SHA1 e8b6dae0a33fa636aa8fa3741926c3a7987cccc7
SHA512 4db965502c886103dc651de3e01e9eccfe30bff3eb1a2b52abea002bcdc1989c3c1ed742aef21dcae979a1cbe55087903529204c0c994bc34436d5b6778788e1
SSDEEP 6144:7cGTZggC8heawvACKE3HsZarWJ64UOl0p0TaZlY4ORh73iTl:I6ZwvAkHsZI7PK0DZu5g
TLSH
T145746C15E7A504A9F277C178C9638916EB767C4603A0EAEF13B049993F33FE0663A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mee8xxni.exe

Path C:\ProgramData\EdgeUpdate\7bzdg32h\mee8xxni.exe
Size 350KB
SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
MD5 4fc050633f860b43e66f4a43b06795b7
SHA1 128533b22c908239f6aa22486fbf66ac8fc9822f
SHA512 cc2e6871fe9e5db154923c57ea161ad265af268346d35f59e4490e93b30940a0105a9725e7c2ffbd9bf826109a8e09313f48a0ff58fd7fe0447a4644ce42babc
SSDEEP 6144:HLvQi6Lx4OtdU2eA37Z1/UoInhMho9guvV99nL:HzQRxleArZ1shukfnL
TLSH
T1BD742719BE6448E5F966A2FC8A758F4AE6717C150B21D7CF0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\7bzdg32h\webview_support.dll
Size 160KB
SHA256 6acc476fc3909a5c0154fe35156794ed695e243b12893b6a57f4be91a247fb7e
MD5 bea439b4994ff4021a24ecd1067d17b4
SHA1 c8715ee7d22bfba98b54161b474a0a3967b190f6
SHA512 dc0bbdbd6e222b68d4e01e03de209d795a43b2b6a87d136bd4db42037b384972b6486a9c4e7428a961dc9dc4c9976eb6d11e71deccc4f8fea66bf83aa61d7132
SSDEEP 3072:70yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:RDLsL1WpCTLe1wZ
TLSH
T1D2F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\bwjw3ba3\webview_support.dll
Size 160KB
SHA256 aeb02273481f65907857126b57d8ba9fe47eadf6c99dec6b26f511c74cd23d8e
MD5 3fe89d9f1abcb928792a1335b8efc91b
SHA1 a43c5f8339d4f922a7439aa9f707d8466a89d2b6
SHA512 0e0019fb3b3fe955d90d440a3c3455e765804969131c09728555c070dcb63785614cad1f09e67882319e7f037c99312e3f45865c714765e7cd6780c4618eb571
SSDEEP 3072:j0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:ZDLsL1WpCTLe1wZ
TLSH
T1B0F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\enhgqajz\webview_support.dll
Size 160KB
SHA256 f3bc2ccb9730eb95ad1e3db23de1d2e0f34b5bb43dc062318b167aca74fd1b36
MD5 2f5ec3d03b80fa26e506d6321bf51b8b
SHA1 9bd43c595b260531c2102a0ad248c93bd88567a9
SHA512 a6cd6a1c5433b0ca31da04fdf4758741db01f5987a023f98c584a0324db869bff1954b37949cc7b12008d0060df5910ab5dd9137dc19b2baf42befbfb6389f74
SSDEEP 3072:70yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:RDLsL1WpCTLe1wZ
TLSH
T1A6F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\fne736z6\webview_support.dll
Size 160KB
SHA256 a10d2f61cba881da20ea17300d2aae2233036e6310fd9df1a515ffcf51fe6dd9
MD5 2ebe131e15343d3942645e56e7621696
SHA1 8e8022ee38a86bdf27fc16a0a3af74302c35e2dc
SHA512 192178fbc5d6843fa55dda2cfb8abd2a95f37c1be7b441d7f92d9538efa8a0d97a1862c649ca871472928e2e169078787702e857d98a6a538f892d102b6ada64
SSDEEP 3072:P0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:NDLsL1WpCTLe1wZ
TLSH
T196F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\i0md4vv3\webview_support.dll
Size 160KB
SHA256 8b254e2f0bc4954237ff7d14b0f5ce42a75fb148d4d86f931f5c9494aaa83888
MD5 f4167dd2e6cbaff40ec8299c0e21087c
SHA1 ee912bd71ce890b98521472c9022cc5db80deae6
SHA512 70ebf45ad87ef89d2cca6e0869a3b7b8d05b614621a4a547876c09061444588967b26b7582b48ed2d2828278842721890a97ab1c5b992464bf098c0e661acf75
SSDEEP 3072:70yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:RDLsL1WpCTLe1wZ
TLSH
T1FEF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\kotozkjk\webview_support.dll
Size 160KB
SHA256 fe6a23b3a01bd10b740de960b00355b63ce3b85986c9e64208abbb2d62f0e45c
MD5 323c241ae9492c17a432b959f8e1cab9
SHA1 cb2d23295aba5b9cf854ab098b0d1484a0e62d04
SHA512 3b3dd468c5c9bb8b61fe0fa8384aed306bbd6add0bd0065af230f8d71e8c67be3743b92b14c5f435f6d3489538f2bbf538e9d8b7baa541661acdd8f752541088
SSDEEP 3072:p0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:/DLsL1WpCTLe1wZ
TLSH
T11DF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\lyqymj8t\webview_support.dll
Size 160KB
SHA256 5079cf3cfe1cac23acd4a8ab021ab993168203b5bd3076314e531676e695390c
MD5 074137ddd0f3080bdf27e9ece3fe9bb7
SHA1 7c7eb5acb3d15c7db302d5cf1ac00e1e5d9aebab
SHA512 55c336d36ad88e24f89d89f61e7d87daf3fc2c218d83fc176b7ef34f2e58c67446819911db4ec5b4d253c5e8d409cf444a8ecd3fa7e335df53fed9fc84ce3fa4
SSDEEP 3072:E0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:ODLsL1WpCTLe1wZ
TLSH
T1E3F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\nwomeody\webview_support.dll
Size 160KB
SHA256 d451e6914f8139d47ee6c2349a9db3cfcb287e1607d9f8839107c6bc91f6b535
MD5 83c6cc7edd13d053a807ea6caefed426
SHA1 12d86f6d8a2151ddafaab94f58794e12c25fe87a
SHA512 eaec90e089eb3fc18d2af85eb52f181d02fd725779732ad3a1ea48b9f1d1c3df2a1409884b38cf66b8f511ccd895e2cd7b54c63b2ab7934b059681d9798e8c7b
SSDEEP 3072:00yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:eDLsL1WpCTLe1wZ
TLSH
T1A0F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\tetqojvu\webview_support.dll
Size 160KB
SHA256 2c3148d867bb62cc5e8541740ad960562b1e56644f554f7fd61e6a3ae19004a3
MD5 6e992077bdfa47deaa96689962fd2d4f
SHA1 889c9977bb333184bc6fe23a5987350f44519559
SHA512 697f59d495a1f2859a139e070104496bf6020acda17c2d08dade991769f4c7f3c8a1bd09aeb6180b1ecfac9cba22d45ea0f2ffbe5dd14a75abfb6c88dc82cf0f
SSDEEP 3072:K0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:sDLsL1WpCTLe1wZ
TLSH
T19EF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\vcss9jea\webview_support.dll
Size 160KB
SHA256 dd18f4dac4c045bd09bb8df5a06bda0c190f88380071de17994bc6a44aa7663b
MD5 e73c05e8bfe024afcea5c066aa84aae2
SHA1 ac8583e66ca7b05b9d68c02716203f9e63259aa6
SHA512 4d5902012d6d28122357367630c1686492578439be12d52e5d08fc6c34227f471a4112260ef7df8b50d16ff3c6144f4caa53d81d24adf62a61544d8afe433451
SSDEEP 3072:W0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:ADLsL1WpCTLe1wZ
TLSH
T1BFF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\zguawdng\webview_support.dll
Size 160KB
SHA256 3442135e88e8f1160bace06174c3e28f32b113c160a9fc8ec00dda0ad4cb97c7
MD5 a68b2443b644d279a3d3b2a085a41604
SHA1 3472026b205f35efd84f1fc4926293d2cbc03862
SHA512 491a394e9606856cd704ecd76d6ccf6b1af7d04f79019f0dd686d7c23207c6e85b4106ce2c2e580157c4368e29aaf52c73ada7a6626b24f9f8f8cbdb6282c977
SSDEEP 3072:80yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:GDLsL1WpCTLe1wZ
TLSH
T168F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download