Analysis
- max time kernel
106s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/08/2026, 05:06
General
- Target StatementofAccoun.exe
- Size 382KB
- Sample260823-frq71sshlf
- SHA256 ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.75.119.86:5353
-
campaign_date
2026-08-04
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 10 IoCs
- Windows security bypass 2 TTPs 48 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Windows security bypass
- Enumerates connected drives
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\StatementofAccoun.exe"C:\Users\Admin\AppData\Local\Temp\StatementofAccoun.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\ProgramData\EdgeUpdate\yjx96ybs\rzv2af1g.exeC:\ProgramData\EdgeUpdate\yjx96ybs\rzv2af1g.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\y8b13sh9\byv7ppx4.exeC:\ProgramData\EdgeUpdate\y8b13sh9\byv7ppx4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\ck4lumls\26ekxfue.exeC:\ProgramData\EdgeUpdate\ck4lumls\26ekxfue.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\uecswmnx\ls318u6r.exeC:\ProgramData\EdgeUpdate\uecswmnx\ls318u6r.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\7dv70uh4\qvxe6ksk.exeC:\ProgramData\EdgeUpdate\7dv70uh4\qvxe6ksk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\yvm8nboc\sp9lxj8c.exeC:\ProgramData\EdgeUpdate\yvm8nboc\sp9lxj8c.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\e9dvcjt1\e3wgawk8.exeC:\ProgramData\EdgeUpdate\e9dvcjt1\e3wgawk8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Windows security bypass
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\g2skckoo\a3dv6fxa.exeC:\ProgramData\EdgeUpdate\g2skckoo\a3dv6fxa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\EdgeUpdate\0tcsi1sg\eyz4b0wc.exeC:\ProgramData\EdgeUpdate\0tcsi1sg\eyz4b0wc.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\ProgramData\EdgeUpdate\nbcm2tir\r0hl3983.exeC:\ProgramData\EdgeUpdate\nbcm2tir\r0hl3983.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\ProgramData\EdgeUpdate\bf3ld17y\cml8lyuj.exeC:\ProgramData\EdgeUpdate\bf3ld17y\cml8lyuj.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\ProgramData\EdgeUpdate\xse5zf1q\d9hp0z4m.exeC:\ProgramData\EdgeUpdate\xse5zf1q\d9hp0z4m.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
webview_support.dll
webview_support.dll
webview_support.dll
webview_support.dll
webview_support.dll
webview_support.dll
webview_support.dll
webview_support.dll
webview_support.dll
config.log
rzv2af1g.exe
webview_support.dll
webview_support.dll
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Plg776D.tmp
__PSScriptPolicyTest_kkdetnnr.ngk.ps1
memory/1272-39-0x00000271F9AE0000-0x00000271F9B02000-memory.dmp
memory/1272-30-0x00000271F8E20000-0x00000271F8E30000-memory.dmp
memory/1272-31-0x00000271F8E20000-0x00000271F8E30000-memory.dmp
memory/2200-101-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-93-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-100-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-98-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-97-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-96-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-90-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-91-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-92-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2200-94-0x00000000014D0000-0x000000000152F000-memory.dmp
memory/2548-225-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-229-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-228-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-227-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-226-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-233-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-235-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-231-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/2548-232-0x0000000000E90000-0x0000000000EEF000-memory.dmp
memory/3248-9-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-8-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-1-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-3-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-25-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/3248-11-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-117-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/3248-2-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-0-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-74-0x0000000000D20000-0x0000000000D21000-memory.dmp
memory/3248-7-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-4-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-6-0x00000000087C0000-0x000000000881E000-memory.dmp
memory/3248-208-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/3248-163-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/3248-5-0x0000000002D90000-0x0000000002DE6000-memory.dmp
memory/3820-45-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-57-0x0000000180000000-0x0000000180103000-memory.dmp
memory/3820-48-0x0000000000B90000-0x0000000000BE8000-memory.dmp
memory/3820-47-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-46-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-44-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-43-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-50-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-51-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-52-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-54-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/3820-55-0x0000000001180000-0x00000000011DF000-memory.dmp
memory/4160-186-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-191-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-182-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-181-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-179-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-178-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-185-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-184-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-180-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4160-190-0x0000000001070000-0x00000000010CF000-memory.dmp
memory/4716-134-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-146-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-145-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-137-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-136-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-135-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-143-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-133-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-141-0x0000000000820000-0x000000000087F000-memory.dmp
memory/4716-142-0x0000000000820000-0x000000000087F000-memory.dmp