valleyrat_s2 | 3fb86b9f8d2751a061ad6afb9e9e28362d67473d60214ebf82a3c3806ced0f55

Analysis

max time kernel
76s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wmicodegen.dll
Size 377KB
Sample260827-xt4dssyyay
SHA256 3fb86b9f8d2751a061ad6afb9e9e28362d67473d60214ebf82a3c3806ced0f55
MD5 87e45663cc6589260948053483e7a72c
SHA1 cdb714f4fa73a4d761f275f33a33a16ed119923b
SHA512 9a3d634ce166659f42ef5580664904c5634d9c3b5b5fa423c109c057ac5bf843742954de60e4e976c1d73349a4a975d4005eebdb25dd69e5731e653375d7c952
SSDEEP 6144:FlkGiJqIWCohnlm+TM4xxiN4BQBGqxXSD2NNlpomMHG5hTayk/k70HGcPL:FiYOenk+7xxqqARFF/DMHG5hTayMkQbj
TLSH
T1F48422E972A925FCE5F7C9348B223037C7243524A319D8AFD4D4E9971F2B932BB52502
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

47.75.119.86:5353

Attributes

campaign_date
2026-08-12

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 9 IoCs

resource	yara_rule
behavioral3/memory/5520-11-0x0000000003DC0000-0x0000000003E1F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/6012-69-0x0000000001010000-0x000000000106F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/6012-70-0x0000000001010000-0x000000000106F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/4492-111-0x00000000028D0000-0x000000000292F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/4492-112-0x00000000028D0000-0x000000000292F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/6072-153-0x0000000002380000-0x00000000023DF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/3892-195-0x0000000000DE0000-0x0000000000E3F000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/5920-238-0x00000000010A0000-0x00000000010FF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral3/memory/5920-239-0x00000000010A0000-0x00000000010FF000-memory.dmp	family_valleyrat_stage_2_v2

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4624	powershell.exe
7128	powershell.exe
5596	powershell.exe
2840	powershell.exe
3132	powershell.exe
1040	powershell.exe
6872	powershell.exe
4568	powershell.exe
5088	powershell.exe
628	powershell.exe
6748	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1264	1y61hkl5.exe
4452	ebvpwvd6.exe
2512	zeoxd74v.exe
1312	rnoh8nge.exe
5588	6xfg6yxm.exe

Loads dropped DLL 5 IoCs

pid	Process
1264	1y61hkl5.exe
4452	ebvpwvd6.exe
2512	zeoxd74v.exe
1312	rnoh8nge.exe
5588	6xfg6yxm.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4528	rundll32.exe
4528	rundll32.exe
4528	rundll32.exe
4528	rundll32.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5520	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeIncreaseQuotaPrivilege	4624	powershell.exe
Token: SeSecurityPrivilege	4624	powershell.exe
Token: SeTakeOwnershipPrivilege	4624	powershell.exe
Token: SeLoadDriverPrivilege	4624	powershell.exe
Token: SeSystemProfilePrivilege	4624	powershell.exe
Token: SeSystemtimePrivilege	4624	powershell.exe
Token: SeProfSingleProcessPrivilege	4624	powershell.exe
Token: SeIncBasePriorityPrivilege	4624	powershell.exe
Token: SeCreatePagefilePrivilege	4624	powershell.exe
Token: SeBackupPrivilege	4624	powershell.exe
Token: SeRestorePrivilege	4624	powershell.exe
Token: SeShutdownPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeSystemEnvironmentPrivilege	4624	powershell.exe
Token: SeRemoteShutdownPrivilege	4624	powershell.exe
Token: SeUndockPrivilege	4624	powershell.exe
Token: SeManageVolumePrivilege	4624	powershell.exe
Token: 33	4624	powershell.exe
Token: 34	4624	powershell.exe
Token: 35	4624	powershell.exe
Token: 36	4624	powershell.exe
Token: SeIncreaseQuotaPrivilege	4624	powershell.exe
Token: SeSecurityPrivilege	4624	powershell.exe
Token: SeTakeOwnershipPrivilege	4624	powershell.exe
Token: SeLoadDriverPrivilege	4624	powershell.exe
Token: SeSystemProfilePrivilege	4624	powershell.exe
Token: SeSystemtimePrivilege	4624	powershell.exe
Token: SeProfSingleProcessPrivilege	4624	powershell.exe
Token: SeIncBasePriorityPrivilege	4624	powershell.exe
Token: SeCreatePagefilePrivilege	4624	powershell.exe
Token: SeBackupPrivilege	4624	powershell.exe
Token: SeRestorePrivilege	4624	powershell.exe
Token: SeShutdownPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeSystemEnvironmentPrivilege	4624	powershell.exe
Token: SeRemoteShutdownPrivilege	4624	powershell.exe
Token: SeUndockPrivilege	4624	powershell.exe
Token: SeManageVolumePrivilege	4624	powershell.exe
Token: 33	4624	powershell.exe
Token: 34	4624	powershell.exe
Token: 35	4624	powershell.exe
Token: 36	4624	powershell.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeDebugPrivilege	7128	powershell.exe
Token: SeIncreaseQuotaPrivilege	7128	powershell.exe
Token: SeSecurityPrivilege	7128	powershell.exe
Token: SeTakeOwnershipPrivilege	7128	powershell.exe
Token: SeLoadDriverPrivilege	7128	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5520	explorer.exe
6012	explorer.exe
4492	explorer.exe
6072	explorer.exe
3892	explorer.exe
5920	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 5520	4528	rundll32.exe	82
PID 5520 wrote to memory of 6556	5520	explorer.exe
PID 1264 wrote to memory of 4624	1264	1y61hkl5.exe	92
PID 1264 wrote to memory of 6012	1264	1y61hkl5.exe	95
PID 1264 wrote to memory of 6012	1264	1y61hkl5.exe	95
PID 5520 wrote to memory of 4136	5520	explorer.exe
PID 4452 wrote to memory of 7128	4452	ebvpwvd6.exe	99
PID 4452 wrote to memory of 4492	4452	ebvpwvd6.exe	101
PID 4452 wrote to memory of 4492	4452	ebvpwvd6.exe	101
PID 5520 wrote to memory of 3896	5520	explorer.exe
PID 2512 wrote to memory of 5596	2512	zeoxd74v.exe	104
PID 2512 wrote to memory of 6072	2512	zeoxd74v.exe	106
PID 2512 wrote to memory of 6072	2512	zeoxd74v.exe	106
PID 5520 wrote to memory of 2036	5520	explorer.exe
PID 1312 wrote to memory of 2840	1312	rnoh8nge.exe	109
PID 1312 wrote to memory of 3892	1312	rnoh8nge.exe	111
PID 1312 wrote to memory of 3892	1312	rnoh8nge.exe	111
PID 5520 wrote to memory of 5616	5520	explorer.exe
PID 5588 wrote to memory of 3132	5588	6xfg6yxm.exe	114
PID 5588 wrote to memory of 5920	5588	6xfg6yxm.exe	116
PID 5588 wrote to memory of 5920	5588	6xfg6yxm.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Windows security bypass
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wmicodegen.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4528

C:\ProgramData\EdgeUpdate\pfjk5u5b\1y61hkl5.exe
C:\ProgramData\EdgeUpdate\pfjk5u5b\1y61hkl5.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:6012

C:\ProgramData\EdgeUpdate\ayenbo9f\ebvpwvd6.exe
C:\ProgramData\EdgeUpdate\ayenbo9f\ebvpwvd6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:7128
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:4492

C:\ProgramData\EdgeUpdate\hlnb1d12\zeoxd74v.exe
C:\ProgramData\EdgeUpdate\hlnb1d12\zeoxd74v.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5596
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:6072

C:\ProgramData\EdgeUpdate\7axi0sbl\rnoh8nge.exe
C:\ProgramData\EdgeUpdate\7axi0sbl\rnoh8nge.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2840
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Windows security bypass
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:3892

C:\ProgramData\EdgeUpdate\zls754ze\6xfg6yxm.exe
C:\ProgramData\EdgeUpdate\zls754ze\6xfg6yxm.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3132
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:5920

C:\ProgramData\EdgeUpdate\570q77un\ol2rsknh.exe
C:\ProgramData\EdgeUpdate\570q77un\ol2rsknh.exe
1⤵
PID:5352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5088
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1128

C:\ProgramData\EdgeUpdate\o1tct4uw\2ao5t3bs.exe
C:\ProgramData\EdgeUpdate\o1tct4uw\2ao5t3bs.exe
1⤵
PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1040
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6444

C:\ProgramData\EdgeUpdate\612v972x\ramranob.exe
C:\ProgramData\EdgeUpdate\612v972x\ramranob.exe
1⤵
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:628
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3044

C:\ProgramData\EdgeUpdate\l621dt7h\d3ba3qoa.exe
C:\ProgramData\EdgeUpdate\l621dt7h\d3ba3qoa.exe
1⤵
PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6872
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3876

C:\ProgramData\EdgeUpdate\wqaqsgcv\zx9bxp9v.exe
C:\ProgramData\EdgeUpdate\wqaqsgcv\zx9bxp9v.exe
1⤵
PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4568
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5792

C:\ProgramData\EdgeUpdate\d6a0dsgb\ph2tpom5.exe
C:\ProgramData\EdgeUpdate\d6a0dsgb\ph2tpom5.exe
1⤵
PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6748
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webview_support.dll

Path C:\ProgramData\EdgeUpdate\570q77un\webview_support.dll
Size 160KB
SHA256 17f642466816397a103c5eca4a5b193406cc16d6f7c37f766e7f5429f55736fb
MD5 26520cc5bc5193128c3b07208977288f
SHA1 b09ef1bd4b50fbac3cd14a9c68a4e0c7051542a9
SHA512 c6ba209e796cb6ae6d33d563ace1b6cfe8f4ae88d80bac180e55808f73bd9e317b07ad38a1cda63c7282930191b828b54369390c26b1a9a049a6a427e943bf91
SSDEEP 3072:e0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:oDLsL1WpCTLe1wZ
TLSH
T164F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\612v972x\webview_support.dll
Size 160KB
SHA256 0a165094c7cb09e1d00c52b40f3b6e74dcd358145282da000d3eb21a77d12334
MD5 0e93aa02b71f49b26eedb04590bc1bf5
SHA1 c61d9d0eaeba7fe7cb2e23479fef8e581c94c8ac
SHA512 345da234a0aa7816200adc0558d1d1a5088f081473911f37401520c23ecee87a2b334ea044b659c22282e4cd454f3d79fb21419b9a286c630b5944895218a8db
SSDEEP 3072:D0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:5DLsL1WpCTLe1wZ
TLSH
T13DF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\7axi0sbl\webview_support.dll
Size 160KB
SHA256 c75c2e9417be3fa898ac0dbe0d9302a8564b6e01bc1de042acfb9868edf9ea83
MD5 8bb093e134cb79e4bdf499eb9a6a4544
SHA1 d4929afe1c66c2dea413c1c35a0748b13f5d29f0
SHA512 72161275e82515fcb4fadfc04da270a49af5c3753795ddaf7d92afc3168330fdc290407b476035fd223639506f8fdbc4b0756ffd422a95a431ce284bb3219a9a
SSDEEP 3072:10yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:DDLsL1WpCTLe1wZ
TLSH
T160F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\ayenbo9f\webview_support.dll
Size 160KB
SHA256 fe8819f21b71b121e255a22a2af84a1bd6040869f70cb5f342d3161da0c53f94
MD5 4f32cc49c89eab62fca6052e94e16448
SHA1 e4be0668604a8395b54b9291c861cca0ee433a50
SHA512 ec70c20208a9ba16c8ab607b94660f262ee4edc828791aecfaf98c94b7ff4731879ab7a614fcb28d4e737ba4faf2dbca5df8e9cc333eaff9aa7dd8f2671d02da
SSDEEP 3072:T0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:pDLsL1WpCTLe1wZ
TLSH
T123F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\d6a0dsgb\webview_support.dll
Size 160KB
SHA256 c780657c551db227919df7ea819df714b7b3a4d9563e6538d0c9efe39d42bf8e
MD5 ba4bcaf898181aa2a5b2a5e07660b542
SHA1 4173a1aff7133bb64b72ff96d57135590d59ee80
SHA512 49bb8ff21921b72c000ccccc79aa17db424f0e098347d70d9d5d3c8a1156b36e199229b6e7fee772ae63ff182193f9dedb79c648057edcdd787591db54224309
SSDEEP 3072:p0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:/DLsL1WpCTLe1wZ
TLSH
T1FFF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\hlnb1d12\webview_support.dll
Size 160KB
SHA256 a7076cbc841955fc6c9236ecb177e1e180d4c81de92c82984f0ad97da1ad52e4
MD5 2ac602dbfae644bb1a0bd9c3e67838f6
SHA1 8a7556692b75012a73414bdc61706fae0416c338
SHA512 9a7c960319b66f361f395d586f9903fe7e31c9a4895c48034d45dfebc18feb0a25bbdb797ab295b5a7cf08fab6af4fc12569fdb486562d971f1da0ce8970c83c
SSDEEP 3072:F0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:zDLsL1WpCTLe1wZ
TLSH
T108F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\l621dt7h\webview_support.dll
Size 160KB
SHA256 a358393bc60075c344629d8b221739439b4cd486c82e0be3ce61aed4499dffc3
MD5 5397906d8dc741d427ce5b17b2ae3326
SHA1 d7ad428a7629fad434cb6f71f6a144f591b2ab77
SHA512 904671e45fdb3412a4bddac1f0ad7acaf77f3113bc680f452ad47e500ce62b0064da3d8469c479cb5c9bfb62ef3ca20a3790f1c21f2d5f33f50b3b28ad8e0b32
SSDEEP 3072:j0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:ZDLsL1WpCTLe1wZ
TLSH
T1AAF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\o1tct4uw\webview_support.dll
Size 160KB
SHA256 958c4fdbc4924144aea1b9d30a07c5865d22b5ae6ad7c6697448702b6b2e9b79
MD5 6497f35d23ce9895623cb91e2daa4013
SHA1 fb7b672e00c21f57a29c56b1e4a16851e63dc360
SHA512 df811f302c7e6dec72c73cc98e9469d12ae6030a73fa100853bb4f4539511cbaed63037075e30b964a10e4421b37386bc18dd2ffea19d9c1d8b4688c2b0701d9
SSDEEP 3072:C0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:kDLsL1WpCTLe1wZ
TLSH
T142F38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1y61hkl5.exe

Path C:\ProgramData\EdgeUpdate\pfjk5u5b\1y61hkl5.exe
Size 350KB
SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
MD5 4fc050633f860b43e66f4a43b06795b7
SHA1 128533b22c908239f6aa22486fbf66ac8fc9822f
SHA512 cc2e6871fe9e5db154923c57ea161ad265af268346d35f59e4490e93b30940a0105a9725e7c2ffbd9bf826109a8e09313f48a0ff58fd7fe0447a4644ce42babc
SSDEEP 6144:HLvQi6Lx4OtdU2eA37Z1/UoInhMho9guvV99nL:HzQRxleArZ1shukfnL
TLSH
T1BD742719BE6448E5F966A2FC8A758F4AE6717C150B21D7CF0370721A3F336E28D39621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.log

Path C:\ProgramData\EdgeUpdate\pfjk5u5b\config.log
Size 350KB
SHA256 23c8cf3e6a62ada2c5d5e52781410b44a1e383625430069da95cbc1720010818
MD5 9c4673afab93b9f0d37049acfbbbcc47
SHA1 ca0695d9e964fe74d24525fd8ad1c8b7a682fc2d
SHA512 3b437d6833507b70072563b1d623d5337da95a9b3e75bc08ff7f8e3bdf10a8f3f1b9b5f0b49c2f49ef45e52e0ff26257cf0350abedc724d93f9f80ed74a32fad
SSDEEP 6144:7cGTZggC8heawvACKE3HsZarWJ64UOl0p0TaZlY4ORhb3iTl:I6ZwvAkHsZI7PK0DZu5o
TLSH
T155746C15E7A504A9F277C178C9638916EB767C4603A0EAEF13B049993F33FE0663A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\pfjk5u5b\webview_support.dll
Size 160KB
SHA256 a0aa9020465eb7813de26eed75ec13d2214d9c9feb63f68d3daea14bd205e86f
MD5 b82ca94759eaab5bad683a6ff1165040
SHA1 576cf73b3f17f8640cfe5b670f20536df042165f
SHA512 92f28eaf8020696e7d8126acd42da7331e80b7400588b95068b51747190be4f642df8566a2b841412a2669dbbf6a20149a6ebab7776d8a8b82a997eaccbc646f
SSDEEP 3072:F0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:zDLsL1WpCTLe1wZ
TLSH
T1FEF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\wqaqsgcv\webview_support.dll
Size 160KB
SHA256 2f90a658201383a95fba311ebdd33f2438fa86036daaa15bdb726e24c84f6db9
MD5 88f979a22e874a1ae683824cf6669f54
SHA1 78fad2c4a9760aa363cc7db3bf095af4614a137b
SHA512 3975456fab868b201f4b34a1d3e73aad56aebf6b4b9b9c2d1242d6b3f93b11f97de878715898dd16b5c311b4bc7b5d1c09a998af3b2930d73c64ee63ac24eb9f
SSDEEP 3072:+0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:IDLsL1WpCTLe1wZ
TLSH
T14EF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview_support.dll

Path C:\ProgramData\EdgeUpdate\zls754ze\webview_support.dll
Size 160KB
SHA256 5af398ccaebfca4b5d47ae1e7d056310193efcf1054d042d131f19b94253a245
MD5 ec3224fede25e309d324227f9d37fccc
SHA1 88e72f2f1cfcb24df871847090a91642d69fe5b8
SHA512 bf6bafbb74433f35045261f799356dd30b88ec5cecd0162684d4d04dc86921595603022d25f493d950bbddc72aece37e2e3dd9f66b9a086a2a600406caa181aa
SSDEEP 3072:C0yDLsRd1WpCYtkUgZHfU1WfdVBTLbsI3Y:kDLsL1WpCTLe1wZ
TLSH
T1FCF38D17F6A6107BD57B8634C9630A05EB32BC454BA0AADF03900AF65E7B7D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download