Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/09/2026, 06:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
192.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
192.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 192.exe
- Size 5.7MB
- Sample260901-g1e2satcqa
- SHA256 21bfcedfb79ec8427ad3d766b66997983a2910d05164773159263b52a5cd6317
- MD5 a7419e5d74c16467b624831100693684
- SHA1 08824d14c9428e047645c9baa822964d7e8657b9
- SHA512 763e240664a75912b675c87264959ba069d81ab339b58829933243d89c5c5a2a656d919f2d46a4b2ae77b5ea89a324c4e6e58c25fc58f45162b981b1f352ce6a
- SSDEEP 49152:NiOKtTM3Xg9vcz6Xi6idfnM4ie1DWFRMZyumMkuAUa7GuQftfV4ZvkK/pafKiK96:NkZJdiBbWRomMjAD/RAUuIc6EF
- TLSH T1F0563A47EC9659E9C1AAE23489679253BB717C881B3123D32B50F7382F76BD06E79340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 6 IoCs
resource yara_rule behavioral1/memory/4376-6-0x0000024D89150000-0x0000024D8919D000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4376-13-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4376-7-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4376-14-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4376-15-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4376-16-0x0000000180000000-0x0000000180055000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4376 rundll32.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 2 3940 192.exe - Loads dropped DLL 1 IoCs
pid Process 4376 rundll32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aom = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Vault\\aom.dll\",Ava" 192.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\Z: rundll32.exe - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe 4376 rundll32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4376 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3940 wrote to memory of 4376 3940 192.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\192.exe"C:\Users\Admin\AppData\Local\Temp\192.exe"1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\Microsoft\Vault\aom.dll Ava2⤵
- Badlisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4376
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Vault\aom.dat
- Size 306KB
- SHA256 484a9a4a6be2c25b6b8bc26c5b2e048963e405771c42d7dcb5e3cd5932810c86
- MD5 4f8a8b274e3a85f1760a41790e7cc9f7
- SHA1 620a33155628ae88c46c40fc257be5a3619876e7
- SHA512 fe03ac6b9a131ca6af0c931794fb95605a7fa9f9971c34a26af37ad415b6bb164f02db3d2a53c1b3870d8fb4cd3849d9649e5a95ed71a26afab0c637bc3c3a95
- SSDEEP 6144:pTjI3rYUtCz2bng+8+gmSLs8zoDwLqbNkTdMbD3:pTjI7HC6bng+ysyoDwKkTGP3
- TLSH T1EC6423BD43CBD69FD9BBE3CF0167A808FAF690075A14E2ADCA158E45B375048181D72B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Vault\aom.dll
- Size 149KB
- SHA256 6516223db6338b7a702d3a2dd961628c53e0de37dee401701ca612335c15ee75
- MD5 e19e8beddea5958105c95ae58c18f274
- SHA1 02b4aa4986cee86e48438865a8fb280e506d356e
- SHA512 3f8a4c40bbf10455d842d7722cca7fe2692ebfc0f45a8620af99eaceddfe526771ff0271a9372e30b90b5ba0b1d3c23e0f3a1e95fdc1b30f112007aae9fafb91
- SSDEEP 3072:kVGJqVglEDECSxTl5x+Jbm5vXErU0FDH3ai:icqCE4CSdlwbOUrU0x
- TLSH T184E31827739245FAD53BD23386DA93729572F4421320B70F2A29DB223F14D689B1F7A4
- MD5 SHA1 SHA512 SSDEEP TLSH