valleyrat_s2 | ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47

Analysis

max time kernel
73s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
StatementofAccoun.exe
Size 382KB
Sample260823-frq71sshlf
SHA256 ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47
MD5 32b03da03c2fec73d028114276a897da
SHA1 2473216fee29bcc660694c32f0a6378295b1e896
SHA512 5539b28f8d0679b992d744c70872d933fc11caa069b6d8388734487de43bf5464505e2c11f2281c53394c76ed1fdb4e09c4462a4e6e25d534c1ecc3a43853c00
SSDEEP 6144:IfGoU5G8+K848hEBbS81wfDM5rMOMT+pcBrk:ek5G8N847bS8v5rMOMT/rk
TLSH
T1DB847C5AF7A404F5D0AB8239C9638506E7727C9A0770DB8F23A4476B2F272E05D3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

47.75.119.86:5353

Attributes

campaign_date
2026-08-04

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 9 IoCs

resource	yara_rule
behavioral2/memory/2136-11-0x0000000003DE0000-0x0000000003E3E000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1808-65-0x0000000002130000-0x000000000218F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1808-66-0x0000000002130000-0x000000000218F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3828-108-0x0000000003110000-0x000000000316F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3828-109-0x0000000003110000-0x000000000316F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/828-150-0x00000000008F0000-0x000000000094F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/4816-192-0x00000000021D0000-0x000000000222F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3604-234-0x0000000000E30000-0x0000000000E8F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3604-235-0x0000000000E30000-0x0000000000E8F000-memory.dmp	family_valleyrat_stage_2_v2

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3412	powershell.exe
5200	powershell.exe
4276	powershell.exe
4112	powershell.exe
688	powershell.exe
4392	powershell.exe
4620	powershell.exe
5104	powershell.exe
1052	powershell.exe
3396	powershell.exe
6116	powershell.exe
5980	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe

Executes dropped EXE 5 IoCs

pid	Process
5468	z9fdw086.exe
2920	f6ue89tb.exe
4720	qmmmq4nx.exe
4960	nj28klxn.exe
6100	ie0c6003.exe

Loads dropped DLL 6 IoCs

pid	Process
2136	explorer.exe
5468	z9fdw086.exe
2920	f6ue89tb.exe
4720	qmmmq4nx.exe
4960	nj28klxn.exe
6100	ie0c6003.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2416	StatementofAccoun.exe
2416	StatementofAccoun.exe
2416	StatementofAccoun.exe
2416	StatementofAccoun.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	powershell.exe
Token: SeSecurityPrivilege	3412	powershell.exe
Token: SeTakeOwnershipPrivilege	3412	powershell.exe
Token: SeLoadDriverPrivilege	3412	powershell.exe
Token: SeSystemProfilePrivilege	3412	powershell.exe
Token: SeSystemtimePrivilege	3412	powershell.exe
Token: SeProfSingleProcessPrivilege	3412	powershell.exe
Token: SeIncBasePriorityPrivilege	3412	powershell.exe
Token: SeCreatePagefilePrivilege	3412	powershell.exe
Token: SeBackupPrivilege	3412	powershell.exe
Token: SeRestorePrivilege	3412	powershell.exe
Token: SeShutdownPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeSystemEnvironmentPrivilege	3412	powershell.exe
Token: SeRemoteShutdownPrivilege	3412	powershell.exe
Token: SeUndockPrivilege	3412	powershell.exe
Token: SeManageVolumePrivilege	3412	powershell.exe
Token: 33	3412	powershell.exe
Token: 34	3412	powershell.exe
Token: 35	3412	powershell.exe
Token: 36	3412	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	powershell.exe
Token: SeSecurityPrivilege	3412	powershell.exe
Token: SeTakeOwnershipPrivilege	3412	powershell.exe
Token: SeLoadDriverPrivilege	3412	powershell.exe
Token: SeSystemProfilePrivilege	3412	powershell.exe
Token: SeSystemtimePrivilege	3412	powershell.exe
Token: SeProfSingleProcessPrivilege	3412	powershell.exe
Token: SeIncBasePriorityPrivilege	3412	powershell.exe
Token: SeCreatePagefilePrivilege	3412	powershell.exe
Token: SeBackupPrivilege	3412	powershell.exe
Token: SeRestorePrivilege	3412	powershell.exe
Token: SeShutdownPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeSystemEnvironmentPrivilege	3412	powershell.exe
Token: SeRemoteShutdownPrivilege	3412	powershell.exe
Token: SeUndockPrivilege	3412	powershell.exe
Token: SeManageVolumePrivilege	3412	powershell.exe
Token: 33	3412	powershell.exe
Token: 34	3412	powershell.exe
Token: 35	3412	powershell.exe
Token: 36	3412	powershell.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeShutdownPrivilege	2136	explorer.exe
Token: SeCreatePagefilePrivilege	2136	explorer.exe
Token: SeDebugPrivilege	4392	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	explorer.exe
1808	explorer.exe
3828	explorer.exe
828	explorer.exe
4816	explorer.exe
3604	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2136	2416	StatementofAccoun.exe	80
PID 2136 wrote to memory of 3808	2136	explorer.exe
PID 5468 wrote to memory of 3412	5468	z9fdw086.exe	92
PID 5468 wrote to memory of 1808	5468	z9fdw086.exe	95
PID 5468 wrote to memory of 1808	5468	z9fdw086.exe	95
PID 2136 wrote to memory of 1364	2136	explorer.exe
PID 2920 wrote to memory of 4392	2920	f6ue89tb.exe	99
PID 2920 wrote to memory of 3828	2920	f6ue89tb.exe	101
PID 2920 wrote to memory of 3828	2920	f6ue89tb.exe	101
PID 2136 wrote to memory of 5968	2136	explorer.exe
PID 4720 wrote to memory of 5200	4720	qmmmq4nx.exe	104
PID 4720 wrote to memory of 828	4720	qmmmq4nx.exe	106
PID 4720 wrote to memory of 828	4720	qmmmq4nx.exe	106
PID 2136 wrote to memory of 2472	2136	explorer.exe
PID 4960 wrote to memory of 4620	4960	nj28klxn.exe	109
PID 4960 wrote to memory of 4816	4960	nj28klxn.exe	111
PID 4960 wrote to memory of 4816	4960	nj28klxn.exe	111
PID 2136 wrote to memory of 5044	2136	explorer.exe
PID 6100 wrote to memory of 5104	6100	ie0c6003.exe	114
PID 6100 wrote to memory of 3604	6100	ie0c6003.exe	116
PID 6100 wrote to memory of 3604	6100	ie0c6003.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Windows security bypass
- Enumerates connected drives
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\StatementofAccoun.exe
  "C:\Users\Admin\AppData\Local\Temp\StatementofAccoun.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2416

C:\ProgramData\EdgeUpdate\4991c8y9\z9fdw086.exe
C:\ProgramData\EdgeUpdate\4991c8y9\z9fdw086.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:1808

C:\ProgramData\EdgeUpdate\e4oez9gx\f6ue89tb.exe
C:\ProgramData\EdgeUpdate\e4oez9gx\f6ue89tb.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4392
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3828

C:\ProgramData\EdgeUpdate\j8j4rbck\qmmmq4nx.exe
C:\ProgramData\EdgeUpdate\j8j4rbck\qmmmq4nx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5200
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:828

C:\ProgramData\EdgeUpdate\psnj0tow\nj28klxn.exe
C:\ProgramData\EdgeUpdate\psnj0tow\nj28klxn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4620
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4816

C:\ProgramData\EdgeUpdate\nk25xdnb\ie0c6003.exe
C:\ProgramData\EdgeUpdate\nk25xdnb\ie0c6003.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5104
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3604

C:\ProgramData\EdgeUpdate\5ejo0nrm\6dzgrak6.exe
C:\ProgramData\EdgeUpdate\5ejo0nrm\6dzgrak6.exe
1⤵
PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1052
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2972

C:\ProgramData\EdgeUpdate\vvyofvgh\fji6ue56.exe
C:\ProgramData\EdgeUpdate\vvyofvgh\fji6ue56.exe
1⤵
PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3396
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3552

C:\ProgramData\EdgeUpdate\ybgylkj0\2dx4n8xy.exe
C:\ProgramData\EdgeUpdate\ybgylkj0\2dx4n8xy.exe
1⤵
PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4276
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1120

C:\ProgramData\EdgeUpdate\ntlpmsxs\yy8a6u5y.exe
C:\ProgramData\EdgeUpdate\ntlpmsxs\yy8a6u5y.exe
1⤵
PID:5920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6116
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2236

C:\ProgramData\EdgeUpdate\5qi4ln6b\2km5di6p.exe
C:\ProgramData\EdgeUpdate\5qi4ln6b\2km5di6p.exe
1⤵
PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5980
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2744

C:\ProgramData\EdgeUpdate\kot2vhdn\mksmx9xd.exe
C:\ProgramData\EdgeUpdate\kot2vhdn\mksmx9xd.exe
1⤵
PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4112
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5976

C:\ProgramData\EdgeUpdate\rgswcu8l\b2ab4d4v.exe
C:\ProgramData\EdgeUpdate\rgswcu8l\b2ab4d4v.exe
1⤵
PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:688
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.log

Path C:\ProgramData\EdgeUpdate\4991c8y9\config.log
Size 350KB
SHA256 23c8cf3e6a62ada2c5d5e52781410b44a1e383625430069da95cbc1720010818
MD5 9c4673afab93b9f0d37049acfbbbcc47
SHA1 ca0695d9e964fe74d24525fd8ad1c8b7a682fc2d
SHA512 3b437d6833507b70072563b1d623d5337da95a9b3e75bc08ff7f8e3bdf10a8f3f1b9b5f0b49c2f49ef45e52e0ff26257cf0350abedc724d93f9f80ed74a32fad
SSDEEP 6144:7cGTZggC8heawvACKE3HsZarWJ64UOl0p0TaZlY4ORhb3iTl:I6ZwvAkHsZI7PK0DZu5o
TLSH
T155746C15E7A504A9F277C178C9638916EB767C4603A0EAEF13B049993F33FE0663A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\4991c8y9\webview_support.dll
Size 160KB
SHA256 bb84796b66d133d1ceb793e550568172f0dbc88d1dd3e5e27cc7f03ca4de6bcc
MD5 30d69836458c3eab902448c0209e510c
SHA1 e7fa294de7db23ecaba5dbea5125667b527c3217
SHA512 e18197f5152de0e5a180b046e2fd22afc322ddd17740e3f9e9d5ddec596a760beca525900bf741796ed4526496c76250686edd02b9437ba312fdf8f02d288a9a
SSDEEP 3072:q0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:MDLsL1WpCTLe1wZ
TLSH
T134F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z9fdw086.exe

Path C:\ProgramData\EdgeUpdate\4991c8y9\z9fdw086.exe
Size 350KB
SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
MD5 4fc050633f860b43e66f4a43b06795b7
SHA1 128533b22c908239f6aa22486fbf66ac8fc9822f
SHA512 cc2e6871fe9e5db154923c57ea161ad265af268346d35f59e4490e93b30940a0105a9725e7c2ffbd9bf826109a8e09313f48a0ff58fd7fe0447a4644ce42babc
SSDEEP 6144:HLvQi6Lx4OtdU2eA37Z1/UoInhMho9guvV99nL:HzQRxleArZ1shukfnL
TLSH
T1BD742719BE6448E5F966A2FC8A758F4AE6717C150B21D7CF0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\5ejo0nrm\webview_support.dll
Size 160KB
SHA256 fc4cbf8298d7c153a90baa3fd1468f1020e613662e5b37ad6b15a0ea506251f0
MD5 002d58daa46d5e2dee86e27b6178fb80
SHA1 05177e8f946b929ef4da1c38fd7bcb4eb62deac1
SHA512 64e30bd5f376faa03d4794226b7cf0b45ae38cca29917f16bb82d2850993db5ac97f9449812eef28daeaef81633fb519294719ab4da4573fbbdeab6ceb4fb118
SSDEEP 3072:Q0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:iDLsL1WpCTLe1wZ
TLSH
T1A8F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\5qi4ln6b\webview_support.dll
Size 160KB
SHA256 50716055008ebc4f8a49d72394a425920f35ef074f693b0680bbfa98167d1156
MD5 7853fb5d5b894fb98fc737847902c467
SHA1 56ee1923cfcb503e884a74b7585e8a02a9962ef3
SHA512 63b07f6b0a8a110d36ed5949ac2ac584eaecc72dfd38d94cfe458d558a12edbed650f0a4354e1a196083c8250c1d3c6ce9327dfba3f9d6538ecaa9faa5f31c6d
SSDEEP 3072:I0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:6DLsL1WpCTLe1wZ
TLSH
T1E7F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\e4oez9gx\webview_support.dll
Size 160KB
SHA256 1936406c48a3f41fa02a7a72ec2f8b505de932ad5c4aa93e770018dfd784f4f8
MD5 fd1b6ff3b76767226ff48779f194284c
SHA1 64b1462f74cbd64ec1b7af0c6f92f347e39b0616
SHA512 f52575b181f36497b1cc2a8f066fba7d795e76ffc8a54742a71de2e8018ca0a4887159e084b61ae5361b10a0f9280fd3cf17a159c48ffc63b00adf8dcb3d6980
SSDEEP 3072:10yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:DDLsL1WpCTLe1wZ
TLSH
T198F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\j8j4rbck\webview_support.dll
Size 160KB
SHA256 04eae93cf48da9c09da45b7d289f8317ea6421c233a860ea67af1b15102851a1
MD5 d0543d8e8c5ac348d194655819ddf8a4
SHA1 17143876abe327e34329a2f9977b8f2bb83a9ec4
SHA512 94c19722a61893aa33b00a01390d81551f77f4c84a5665e45f892d59ce698236eab77c1c1d3cc2de2c0261134c604e2cdf7b270d90659a252b0c7b05a960ce54
SSDEEP 3072:r0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:hDLsL1WpCTLe1wZ
TLSH
T1F6F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\kot2vhdn\webview_support.dll
Size 160KB
SHA256 a51e7d4e960d6e2aedaab63b60716c19ab7ddcdfe1a668e869333188fa7c8d43
MD5 be2e27f57d9da811333e53c325eea2ca
SHA1 7efa8471ee0672bc0fd2c19a8e8afa1e09cb6d18
SHA512 642e8f8ab44181788272a0310d2e0021d9032afca0104abee2a28cb08fdf41d2b2eb82b94597ff0179a5977b8da20c7e7c22ed75b0a8e336ca8c76f2bbde0166
SSDEEP 3072:d0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:rDLsL1WpCTLe1wZ
TLSH
T11BF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\nk25xdnb\webview_support.dll
Size 160KB
SHA256 7b252bcd64fb87716b69c70a63ccabda41084e9d4ca84b7677e1590c6fd45d4e
MD5 f96d1ee2f1a6ab9d1b04dfe880463d98
SHA1 e7f3a54f11ab9c21af14632d7f2ca4be4d7396ea
SHA512 ac7c2b67e2d6318fe19d719df4ba9ce2d57b10a1546a64f16f19845095996eccdabb84a8b4aa66248aa1a964772b9e7ebc2d6af15d78340050eb76853d435d8e
SSDEEP 3072:E0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:ODLsL1WpCTLe1wZ
TLSH
T196F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\ntlpmsxs\webview_support.dll
Size 160KB
SHA256 316402921be77c6511b472328d6291b62ebda9575474624733109308ff5f6b3e
MD5 011b862e9af588f036d38abafce2a078
SHA1 e34b016b241d1610273e83dfad321358b77b3724
SHA512 0d9efef04ca6a474d7d295b5dad199615314eeff907461d4e9f52b39f61ffaa9907ddc677f395894bcf23856a76d0caf1ef5724fc0a0e5a9e45c894adb065581
SSDEEP 3072:60yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:8DLsL1WpCTLe1wZ
TLSH
T1FAF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\psnj0tow\webview_support.dll
Size 160KB
SHA256 23065ed57b6ce0a2d4d914fa99a4a40565a6c2982e6bd3848b947712a301f4a6
MD5 7c77a10dc2b678eee321effed6177631
SHA1 d3105130b0208da91270de2341427596fb613cc0
SHA512 711a7500881865d9456fa5fb51fa0f0084382ef6725e1966d0616ddefa049ea29e3261b16387d4ce7a3a64777c7324aead4e99e923719cbf99decc88de2cc730
SSDEEP 3072:p0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:/DLsL1WpCTLe1wZ
TLSH
T16DF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\vvyofvgh\webview_support.dll
Size 160KB
SHA256 85c9e0fe6844af125b5e69aa6f43b6ca3cd4e417545d5094da97beea819f7faa
MD5 5a7091002945a867913b3df63d417e66
SHA1 052754fed6ac655a8ec5bd97baecf70508887aa3
SHA512 dad1e720efbcc9f59a16324ab934c5ed8aad90e961c65eea56f116f74428e71a37cee6cdead2b01e713097d5e7cc4a1d5dff1932a7b499a519507f578a76258c
SSDEEP 3072:/0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:dDLsL1WpCTLe1wZ
TLSH
T1F5F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\ybgylkj0\webview_support.dll
Size 160KB
SHA256 f19805f72f2066eebbc14985bbc9164644f7d41685566201a680d54cd4730ad3
MD5 b729d026ddd53a15ba2b77c562204787
SHA1 17790efd65d0d31df3327b35f2c7f76e55bcc4ef
SHA512 d7e25d32eb0251d2e0acb27d18bd353f8969c4e550e2b8529f0b75562fffc9b0b8367f6f66bf5d99554f99084451aaf1397896f7ad6771155d5aecaa85ce57ab
SSDEEP 3072:Y0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:qDLsL1WpCTLe1wZ
TLSH
T1ACF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download