valleyrat_s2 | 285538c27af4a95adc6302486b11fb1feb2e3d6eb829979ce7b3ecddbbbc8f13

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
285538c27af4a95adc6302486b11fb1feb2e3d6eb829979ce7b3ecddbbbc8f13.dll
Size 5.3MB
Sample260903-ym477aep6x
SHA256 285538c27af4a95adc6302486b11fb1feb2e3d6eb829979ce7b3ecddbbbc8f13
MD5 3f0c797e014e1e13bd429fa1c0a28234
SHA1 79e24978e968dccadd6627f4344a8b9887e48061
SHA512 ce317733d6db27341f41fdf61e2c095d36f2e0e4c5d514cbe079cb11603e8ffa0673b373def43eb8a3a58d2fbcc080af6b175a8214d6016c9867170e238097d9
SSDEEP 98304:kV2k3db7B/kR8eX5asL1C9PXI+iZ7q1zPPXNAjtVa/uh:kVN/eMi1OI+7NAjtVa/uh
TLSH
T16E469E016B9D0588D873E2B8C997CA3BD7727C406225C68B01F0BE5BFFB77521E2A255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware

Malware Config

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/5976-6-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5976-5-0x000002F40A9F0000-0x000002F40AA4B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5976-10-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5976-8-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5976-12-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5976-13-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5976-15-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp	family_valleyrat_stage_2_v2

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5976	rundll32.exe
8	5976	rundll32.exe
9	5976	rundll32.exe
10	5976	rundll32.exe
13	5976	rundll32.exe
15	5976	rundll32.exe
16	5976	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
5192	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
16	icanhazip.com
1	api.ipify.org
1	icanhazip.com

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6060	tasklist.exe
2092	tasklist.exe
2760	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\rundll32.exe	rundll32.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
1244	cmd.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2992	timeout.exe
1932	timeout.exe
1720	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3404	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe
5976	rundll32.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5976	rundll32.exe
Token: SeLoadDriverPrivilege	5976	rundll32.exe
Token: SeTakeOwnershipPrivilege	5976	rundll32.exe
Token: SeIncBasePriorityPrivilege	5976	rundll32.exe
Token: SeTcbPrivilege	5976	rundll32.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	5976	rundll32.exe
Token: SeCreateTokenPrivilege	5976	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	5976	rundll32.exe
Token: SeLockMemoryPrivilege	5976	rundll32.exe
Token: SeIncreaseQuotaPrivilege	5976	rundll32.exe
Token: SeMachineAccountPrivilege	5976	rundll32.exe
Token: SeTcbPrivilege	5976	rundll32.exe
Token: SeSecurityPrivilege	5976	rundll32.exe
Token: SeTakeOwnershipPrivilege	5976	rundll32.exe
Token: SeLoadDriverPrivilege	5976	rundll32.exe
Token: SeSystemProfilePrivilege	5976	rundll32.exe
Token: SeSystemtimePrivilege	5976	rundll32.exe
Token: SeProfSingleProcessPrivilege	5976	rundll32.exe
Token: SeIncBasePriorityPrivilege	5976	rundll32.exe
Token: SeCreatePagefilePrivilege	5976	rundll32.exe
Token: SeCreatePermanentPrivilege	5976	rundll32.exe
Token: SeBackupPrivilege	5976	rundll32.exe
Token: SeRestorePrivilege	5976	rundll32.exe
Token: SeShutdownPrivilege	5976	rundll32.exe
Token: SeDebugPrivilege	5976	rundll32.exe
Token: SeAuditPrivilege	5976	rundll32.exe
Token: SeSystemEnvironmentPrivilege	5976	rundll32.exe
Token: SeChangeNotifyPrivilege	5976	rundll32.exe
Token: SeRemoteShutdownPrivilege	5976	rundll32.exe
Token: SeUndockPrivilege	5976	rundll32.exe
Token: SeSyncAgentPrivilege	5976	rundll32.exe
Token: SeEnableDelegationPrivilege	5976	rundll32.exe
Token: SeManageVolumePrivilege	5976	rundll32.exe
Token: SeImpersonatePrivilege	5976	rundll32.exe
Token: SeCreateGlobalPrivilege	5976	rundll32.exe
Token: 31	5976	rundll32.exe
Token: 32	5976	rundll32.exe
Token: 33	5976	rundll32.exe
Token: 34	5976	rundll32.exe
Token: 35	5976	rundll32.exe
Token: SeDebugPrivilege	6060	tasklist.exe
Token: SeDebugPrivilege	2092	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5976	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 3404	5976	rundll32.exe	89
PID 5976 wrote to memory of 2980	5976	rundll32.exe	94
PID 2980 wrote to memory of 1244	2980	cmd.exe	96
PID 1244 wrote to memory of 6060	1244	cmd.exe	97
PID 1244 wrote to memory of 6036	1244	cmd.exe	98
PID 1244 wrote to memory of 2992	1244	cmd.exe	99
PID 1244 wrote to memory of 2092	1244	cmd.exe	101
PID 1244 wrote to memory of 1200	1244	cmd.exe	102
PID 1244 wrote to memory of 1932	1244	cmd.exe	103
PID 1244 wrote to memory of 2760	1244	cmd.exe	104
PID 1244 wrote to memory of 5204	1244	cmd.exe	105
PID 1244 wrote to memory of 1720	1244	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\285538c27af4a95adc6302486b11fb1feb2e3d6eb829979ce7b3ecddbbbc8f13.dll,#1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\system32\taskkill.exe
  taskkill /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" /B cmd /C C:\Users\Public\Libraries\S-1-5-21-3797332335-34111092-3597280141\S-1-5-21-3797332335-34111092-3597280141.bAt
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\cmd.exe
    cmd /C C:\Users\Public\Libraries\S-1-5-21-3797332335-34111092-3597280141\S-1-5-21-3797332335-34111092-3597280141.bAt
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\tasklist.exe
      TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6060
  - - C:\Windows\system32\find.exe
      FIND /I "rundll32.exe"
      4⤵
      PID:6036
  - - C:\Windows\system32\timeout.exe
      TIMEOUT /t 60 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2992
  - - C:\Windows\system32\tasklist.exe
      TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Windows\system32\find.exe
      FIND /I "rundll32.exe"
      4⤵
      PID:1200
  - - C:\Windows\system32\timeout.exe
      TIMEOUT /t 60 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1932
  - - C:\Windows\system32\tasklist.exe
      TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2760
  - - C:\Windows\system32\find.exe
      FIND /I "rundll32.exe"
      4⤵
      PID:5204
  - - C:\Windows\system32\timeout.exe
      TIMEOUT /t 60 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1720

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
1⤵
- Executes dropped EXE
PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S-1-5-21-3797332335-34111092-3597280141.bAt

Path C:\Users\Public\Libraries\S-1-5-21-3797332335-34111092-3597280141\S-1-5-21-3797332335-34111092-3597280141.bAt
Size 1KB
SHA256 0ed5b15cbb2ad01ee8db80a601d0519c237162e28fe11df94e5f452bbac022bc
MD5 70526d987d53cc5e139f1cac169679ee
SHA1 abcd4366bac4fe7e3d920c5fde0072abf4603b2b
SHA512 02170da7785f54d620eb3522ccea9b28072ceab40377be3585de79b1460f8eb0ed69a0940a975b9892f8e34c49cd23482c1b1d2feeb3ed334a9dd46d8c2fd2e1
TLSH
T16531108FC40B8D0C432102DB135ACC5FC6A0F1C7FE45719070E85B8533A6ABD1856BAD
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe

Path C:\Windows\System32\rundll32.exe
Size 88KB
SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
MD5 025b13bf5652712d9b596e6766a9c386
SHA1 def4011b5536983285472ba75c22c6a2410edf6a
SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
TLSH
T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5976-6-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp

Download

memory/5976-5-0x000002F40A9F0000-0x000002F40AA4B000-memory.dmp

Download

memory/5976-10-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp

Download

memory/5976-8-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp

Download

memory/5976-12-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp

Download

memory/5976-13-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp

Download

memory/5976-15-0x000002F40AB50000-0x000002F40ABB2000-memory.dmp

Download