valleyrat_s2 | 4ba01b04681a5273facdd8b17e7b7b2246ee0eab6168c932946e7e96b9099e2d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20260826.526914.C7B38F1A95D2.exe
Size 47KB
Sample260827-r73frsan21
SHA256 4ba01b04681a5273facdd8b17e7b7b2246ee0eab6168c932946e7e96b9099e2d
MD5 0dcc1bacda98269a9f44a8777ea6e272
SHA1 0d15da2cda421fa8e08cf3881e807baa841b973c
SHA512 1a0ba71c0802892ce55d9b4fffa4165e07c5e8ab55cba6ae2222b00f63ba60c42145b461c58028652fa4f260bad69a257b27d8f7e89e5d0dfeea4292233d6716
SSDEEP 768:agR8YITEd6yuorai4FNDs4AeYiDLk54FPQQ83uYijFPQQ15ALIK:78YIbqrN4Fa4Ae7JZ83u7pZtK
TLSH
T151239DA78ED848D1D8178538A8E19522E9B1B2451BA2C3CB2345C21D0FA67C33FFD3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

170.62.130.47:449
170.62.130.47:443

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/3104-31-0x000001E5FF8C0000-0x000001E5FF910000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3104-32-0x000001E5FF8C0000-0x000001E5FF910000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3104-33-0x000001E5FF8C0000-0x000001E5FF910000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3144-37-0x00000277442B0000-0x0000027744300000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3144-39-0x00000277442B0000-0x0000027744300000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3144-38-0x00000277442B0000-0x0000027744300000-memory.dmp	family_valleyrat_stage_2_v2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceController = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" -onlyctrl"	Loader.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Loader.exe
File opened (read-only)	\??\I:	Loader.exe
File opened (read-only)	\??\V:	Loader.exe
File opened (read-only)	\??\W:	Loader.exe
File opened (read-only)	\??\N:	Loader.exe
File opened (read-only)	\??\U:	Loader.exe
File opened (read-only)	\??\G:	Loader.exe
File opened (read-only)	\??\Q:	Loader.exe
File opened (read-only)	\??\T:	Loader.exe
File opened (read-only)	\??\X:	Loader.exe
File opened (read-only)	\??\Y:	Loader.exe
File opened (read-only)	\??\J:	Loader.exe
File opened (read-only)	\??\B:	Loader.exe
File opened (read-only)	\??\N:	Loader.exe
File opened (read-only)	\??\Q:	Loader.exe
File opened (read-only)	\??\D:	Loader.exe
File opened (read-only)	\??\M:	Loader.exe
File opened (read-only)	\??\O:	Loader.exe
File opened (read-only)	\??\Y:	Loader.exe
File opened (read-only)	\??\W:	Loader.exe
File opened (read-only)	\??\P:	Loader.exe
File opened (read-only)	\??\T:	Loader.exe
File opened (read-only)	\??\U:	Loader.exe
File opened (read-only)	\??\X:	Loader.exe
File opened (read-only)	\??\O:	Loader.exe
File opened (read-only)	\??\P:	Loader.exe
File opened (read-only)	\??\H:	Loader.exe
File opened (read-only)	\??\H:	Loader.exe
File opened (read-only)	\??\K:	Loader.exe
File opened (read-only)	\??\G:	Loader.exe
File opened (read-only)	\??\I:	Loader.exe
File opened (read-only)	\??\K:	Loader.exe
File opened (read-only)	\??\L:	Loader.exe
File opened (read-only)	\??\M:	Loader.exe
File opened (read-only)	\??\B:	Loader.exe
File opened (read-only)	\??\L:	Loader.exe
File opened (read-only)	\??\R:	Loader.exe
File opened (read-only)	\??\D:	Loader.exe
File opened (read-only)	\??\J:	Loader.exe
File opened (read-only)	\??\S:	Loader.exe
File opened (read-only)	\??\Z:	Loader.exe
File opened (read-only)	\??\S:	Loader.exe
File opened (read-only)	\??\V:	Loader.exe
File opened (read-only)	\??\Z:	Loader.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
3564	~tmp_50371.tmp
2056	Loader.exe
3104	Loader.exe
4812	Loader.exe
3144	Loader.exe

Loads dropped DLL 18 IoCs

pid	Process
2056	Loader.exe
2056	Loader.exe
2056	Loader.exe
2056	Loader.exe
2056	Loader.exe
2056	Loader.exe
3104	Loader.exe
3104	Loader.exe
3104	Loader.exe
3104	Loader.exe
4812	Loader.exe
4812	Loader.exe
4812	Loader.exe
4812	Loader.exe
3144	Loader.exe
3144	Loader.exe
3144	Loader.exe
3144	Loader.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1304	cmd.exe
304	cmd.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID	20260826.526914.C7B38F1A95D2.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{877AF8C6-E788-44EB-9F38-99D81A9526D8}\Shell	20260826.526914.C7B38F1A95D2.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{877AF8C6-E788-44EB-9F38-99D81A9526D8}\Shell\Manage	20260826.526914.C7B38F1A95D2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{877AF8C6-E788-44EB-9F38-99D81A9526D8}\Shell\Manage\command	20260826.526914.C7B38F1A95D2.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{877AF8C6-E788-44EB-9F38-99D81A9526D8}	20260826.526914.C7B38F1A95D2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{877AF8C6-E788-44EB-9F38-99D81A9526D8}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" -onlyctrl"	20260826.526914.C7B38F1A95D2.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2836	20260826.526914.C7B38F1A95D2.exe
2836	20260826.526914.C7B38F1A95D2.exe
2836	20260826.526914.C7B38F1A95D2.exe
2836	20260826.526914.C7B38F1A95D2.exe
2056	Loader.exe
2056	Loader.exe
4812	Loader.exe
4812	Loader.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4104	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3444	2836	20260826.526914.C7B38F1A95D2.exe	92
PID 4104 wrote to memory of 2056	4104	explorer.exe	94
PID 2056 wrote to memory of 1304	2056	Loader.exe	96
PID 1304 wrote to memory of 3104	1304	cmd.exe	98
PID 4812 wrote to memory of 304	4812	Loader.exe	101
PID 304 wrote to memory of 3144	304	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\20260826.526914.C7B38F1A95D2.exe
"C:\Users\Admin\AppData\Local\Temp\20260826.526914.C7B38F1A95D2.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\explorer.exe
  explorer.exe shell:::{877AF8C6-E788-44EB-9F38-99D81A9526D8}
  2⤵
  PID:3444

C:\Users\Admin\AppData\Local\Temp\~tmp_50371.tmp
C:\Users\Admin\AppData\Local\Temp\~tmp_50371.tmp
1⤵
- Executes dropped EXE
PID:3564

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104
- C:\ProgramData\OpenraVPN\Loader.exe
  "C:\ProgramData\OpenraVPN\Loader.exe" -onlyctrl
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "C:\ProgramData\OpenraVPN\Loader.exe -reonlyctrl"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\ProgramData\OpenraVPN\Loader.exe
      C:\ProgramData\OpenraVPN\Loader.exe -reonlyctrl
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Executes dropped EXE
      Loads dropped DLL
      PID:3104

C:\ProgramData\OpenraVPN\Loader.exe
"C:\ProgramData\OpenraVPN\Loader.exe" -onlyctrl
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\ProgramData\OpenraVPN\Loader.exe -reonlyctrl"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:304
- - C:\ProgramData\OpenraVPN\Loader.exe
    C:\ProgramData\OpenraVPN\Loader.exe -reonlyctrl
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Loader.exe

Path C:\ProgramData\OpenraVPN\Loader.exe
Size 47KB
SHA256 4ba01b04681a5273facdd8b17e7b7b2246ee0eab6168c932946e7e96b9099e2d
MD5 0dcc1bacda98269a9f44a8777ea6e272
SHA1 0d15da2cda421fa8e08cf3881e807baa841b973c
SHA512 1a0ba71c0802892ce55d9b4fffa4165e07c5e8ab55cba6ae2222b00f63ba60c42145b461c58028652fa4f260bad69a257b27d8f7e89e5d0dfeea4292233d6716
SSDEEP 768:agR8YITEd6yuorai4FNDs4AeYiDLk54FPQQ83uYijFPQQ15ALIK:78YIbqrN4Fa4Ae7JZ83u7pZtK
TLSH
T151239DA78ED848D1D8178538A8E19522E9B1B2451BA2C3CB2345C21D0FA67C33FFD3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\ProgramData\OpenraVPN\msvcp140.dll
Size 572KB
SHA256 b5400f8454276f1adf944d8ba393866ca423603254baf88bca7dc4c1cf762116
MD5 cdf7a0cc26ed6b4136ce69b74d8694ed
SHA1 9d7775e53b051a150bd461b0cacebd206bf875dc
SHA512 deb4397ad18f0267463ac69e629788f5b9c90265ffb69d1f2c360534b6df7c2a0da3c389916430f3a4675ad8ba29c6c6c95dafee07480bfe74fa913934677abd
SSDEEP 12288:49zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVht4y:44wPrALhAYvogQEKZm+jWodEE7P
TLSH
T1C9C41923B74905E0E195E3B891878706D7F1BC4A8312A3C792EBD69D2F673D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.dll

Path C:\ProgramData\OpenraVPN\service.dll
Size 1.4MB
SHA256 38f971647b42d13a8cc01e1efe22dbbc3725e3c200885997008db55a08d7ca05
MD5 da2b5c4dbe8ca9480873e68009d08009
SHA1 22de716e3aab64fce6748244282fc55454052bfd
SHA512 4989009acfdb1bcd3cfb8ef31a32360ee8b48983988e72fbb14f295c83a73350847f18c38777d3cf9b68c191c3826296a3e0f1275a7d2c2fa68cfa032e25a804
SSDEEP 12288:vBhP+LHQlN5YVBQho8wRUIO8e/uCOgxrsFTIxI1Kq7EIoNL0Eh9/lKenZUSEvW01:5IOUzBl
TLSH
T13065F524BDBBC12D4023FB682DDDF4AFE6AA231A1589787B404903174F6DB958B4707E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\OpenraVPN\vcruntime140.dll
Size 127KB
SHA256 98aea63f7c88d733504c08b165fd68a917e256f2cfaeaa742323ef6dddbbce29
MD5 d59f36ddcc7460bf5bcd9fde274982bb
SHA1 062ed05bfabfabe77d63cfa991f8471475aaf776
SHA512 2dd1da4d55ff8a8e2f8528d3c3afd0af31eea5d049fa9dacebac0f194d9a8c265f10426585b734126a3cafe853e7807279ce39e27d95df314c8c9acbe7d1f079
SSDEEP 1536:s9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaE/nzR64zESqY:sEnsvReGsWyxLizXFkecbd1aIn34wT
TLSH
T1BED39D85B2A402B7D16AC174C2E3AE17FB75B94487A0A3CF03B59A650F53BE09E3C355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\ProgramData\OpenraVPN\vcruntime140_1.dll
Size 58KB
SHA256 1a1ca015a830a357ad5ec882845d732a60368b6c0d8247a009140cd518377f73
MD5 0bdae05fc660c889f1a3a6fd0d7ca3e4
SHA1 48572d0da1d1b576f8d9bee7079b2e73edd1f23a
SHA512 84d3ca24b54fc50c86e497e9853b4e0c49f65f04b09879af250471b4416a025dfd4bf393b32e494329c2d05817a811bd3c69d80e0d3dae86d567ca73c85c096b
SSDEEP 768:UzzO6ujT3MbR3v0Cz6Sz5q83ywPg1HfV9zxfkbK9zqaQ9zoQ:hq/oMx3hsHfnzxfkizqBzoQ
TLSH
T116436CA457784082D99B98B0C1EAEE537D7CB7D60B10924B0BE5E5481F633D1EB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~tmp_50371.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tmp_50371.tmp
Size 47KB
SHA256 f25673e1c11c7e32a51e79010aefc8090e91e5235ceaa250cc13d6fccdb6d66f
MD5 193bd61bdf638e40e752dde1d4d985a7
SHA1 29c86bd813533e3734a2c5546b5b74c5f6affbc0
SHA512 baf3b50a5037aa0a6ba1cedd295e8175b48ec1472686286a599d092a618de3ef62634e94853cf069f9f389eb827697ad2de011cb9489371d2d084f52d27caad1
SSDEEP 768:zssuzOhzUogJHWGR+uGR5a/bLIHcewnBpvwzLOdNqc8ocNe+Sct8C:zd6Y2KcewnrwOWc8ocNect8C
TLSH
T116235C534A6928C1FEAA8EB4D1F4DA3BDCB1B6811F8495DF00B180855E62BD07F3865B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3104-31-0x000001E5FF8C0000-0x000001E5FF910000-memory.dmp

Download

memory/3104-40-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3104-29-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3104-28-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3104-15-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3104-30-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3104-32-0x000001E5FF8C0000-0x000001E5FF910000-memory.dmp

Download

memory/3104-33-0x000001E5FF8C0000-0x000001E5FF910000-memory.dmp

Download

memory/3144-34-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3144-27-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3144-36-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3144-37-0x00000277442B0000-0x0000027744300000-memory.dmp

Download

memory/3144-39-0x00000277442B0000-0x0000027744300000-memory.dmp

Download

memory/3144-38-0x00000277442B0000-0x0000027744300000-memory.dmp

Download

memory/3144-35-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3144-42-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3144-43-0x0000000140000000-0x000000014002A000-memory.dmp

Download