Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 05:39
General
- Target 2026-08-20_9511feb3d1423a533aa1050a313f58e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 1.3MB
- Sample260820-gcr2fazfpc
- SHA256 f0a509e993ff9b65141f77d2892498f6ba9cfbfe61f90e505f2e1ea3074fd823
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
154.12.19.70:22011
-
154.12.19.70:22012
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 7 IoCs
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_9511feb3d1423a533aa1050a313f58e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9511feb3d1423a533aa1050a313f58e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\~tmp_42454.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_42454.tmp1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RemoteControllerService -s RemoteControllerService1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exe"C:\Windows\system32\conhost.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Svchost.dll
~tmp_42454.tmp
memory/3164-14-0x0000028E43BC0000-0x0000028E43BE9000-memory.dmp
memory/3164-18-0x0000028E45320000-0x0000028E4536D000-memory.dmp
memory/3164-10-0x0000028E422B0000-0x0000028E42331000-memory.dmp
memory/3164-11-0x0000028E43BC0000-0x0000028E43BE9000-memory.dmp
memory/3164-12-0x0000028E43BC0000-0x0000028E43BE9000-memory.dmp
memory/3164-13-0x0000028E43BC0000-0x0000028E43BE9000-memory.dmp
memory/3164-8-0x0000028E42280000-0x0000028E42281000-memory.dmp
memory/3164-9-0x0000028E43BC0000-0x0000028E43BE9000-memory.dmp
memory/3164-17-0x0000028E45320000-0x0000028E4536D000-memory.dmp
memory/3164-16-0x0000028E45320000-0x0000028E4536D000-memory.dmp
memory/3164-15-0x0000028E451B0000-0x0000028E451F7000-memory.dmp
memory/3164-24-0x0000028E45320000-0x0000028E4536D000-memory.dmp
memory/3164-23-0x0000028E45320000-0x0000028E4536D000-memory.dmp
memory/3164-26-0x0000028E43BC0000-0x0000028E43BE9000-memory.dmp
memory/3164-29-0x0000028E45320000-0x0000028E4536D000-memory.dmp