Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 13:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
323f6232ce475bf0fd9812a5fbdef194aaf7c4eb01854749500a9bc0bb09c02a.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
323f6232ce475bf0fd9812a5fbdef194aaf7c4eb01854749500a9bc0bb09c02a.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 323f6232ce475bf0fd9812a5fbdef194aaf7c4eb01854749500a9bc0bb09c02a.dll
- Size 9.8MB
- Sample260905-qf5ldaea76
- SHA256 323f6232ce475bf0fd9812a5fbdef194aaf7c4eb01854749500a9bc0bb09c02a
- MD5 8327b247e4f8a959a5f497577fd41360
- SHA1 3e32a58acf447301dda86e0588a199c2659a1e73
- SHA512 e6dc09db4255a9f65aa391521807eb59748a95842a593c804673d0c06ca4f2e9f0d004ffa9c9ab7bffa35450cd020d3d7b88b509cfbf223848bebef837596801
- SSDEEP 196608:AQQI9OCDAjyOkxuIsNCzcTY+GkMfPBzgmlI+7NAjtVa/uh:AlwOC0d6uIsO0GJV9B7a
- TLSH T1E1A6AE052E9C0178E472D275C993DA7EE672BC406731968F02E16E4FBF337928D3A265
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 7 IoCs
resource yara_rule behavioral2/memory/6076-5-0x000001C8D3E60000-0x000001C8D3EBB000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/6076-6-0x000001C8D3EC0000-0x000001C8D3F22000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/6076-7-0x000001C8D3EC0000-0x000001C8D3F22000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/6076-10-0x000001C8D3EC0000-0x000001C8D3F22000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/6076-12-0x000001C8D3EC0000-0x000001C8D3F22000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/6076-13-0x000001C8D3EC0000-0x000001C8D3F22000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/6076-25-0x000001C8D3EC0000-0x000001C8D3F22000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 6076 rundll32.exe 6 6076 rundll32.exe 8 6076 rundll32.exe 9 6076 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 4308 rundll32.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 8 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5432 tasklist.exe 1604 tasklist.exe 4332 tasklist.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1964 cmd.exe 6104 cmd.exe - Delays execution with timeout.exe 3 IoCs
pid Process 1556 timeout.exe 2376 timeout.exe 4424 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 5596 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe 6076 rundll32.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 6076 rundll32.exe Token: SeLoadDriverPrivilege 6076 rundll32.exe Token: SeTakeOwnershipPrivilege 6076 rundll32.exe Token: SeIncBasePriorityPrivilege 6076 rundll32.exe Token: SeTcbPrivilege 6076 rundll32.exe Token: SeDebugPrivilege 5596 taskkill.exe Token: SeDebugPrivilege 6076 rundll32.exe Token: SeCreateTokenPrivilege 6076 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 6076 rundll32.exe Token: SeLockMemoryPrivilege 6076 rundll32.exe Token: SeIncreaseQuotaPrivilege 6076 rundll32.exe Token: SeMachineAccountPrivilege 6076 rundll32.exe Token: SeTcbPrivilege 6076 rundll32.exe Token: SeSecurityPrivilege 6076 rundll32.exe Token: SeTakeOwnershipPrivilege 6076 rundll32.exe Token: SeLoadDriverPrivilege 6076 rundll32.exe Token: SeSystemProfilePrivilege 6076 rundll32.exe Token: SeSystemtimePrivilege 6076 rundll32.exe Token: SeProfSingleProcessPrivilege 6076 rundll32.exe Token: SeIncBasePriorityPrivilege 6076 rundll32.exe Token: SeCreatePagefilePrivilege 6076 rundll32.exe Token: SeCreatePermanentPrivilege 6076 rundll32.exe Token: SeBackupPrivilege 6076 rundll32.exe Token: SeRestorePrivilege 6076 rundll32.exe Token: SeShutdownPrivilege 6076 rundll32.exe Token: SeDebugPrivilege 6076 rundll32.exe Token: SeAuditPrivilege 6076 rundll32.exe Token: SeSystemEnvironmentPrivilege 6076 rundll32.exe Token: SeChangeNotifyPrivilege 6076 rundll32.exe Token: SeRemoteShutdownPrivilege 6076 rundll32.exe Token: SeUndockPrivilege 6076 rundll32.exe Token: SeSyncAgentPrivilege 6076 rundll32.exe Token: SeEnableDelegationPrivilege 6076 rundll32.exe Token: SeManageVolumePrivilege 6076 rundll32.exe Token: SeImpersonatePrivilege 6076 rundll32.exe Token: SeCreateGlobalPrivilege 6076 rundll32.exe Token: 31 6076 rundll32.exe Token: 32 6076 rundll32.exe Token: 33 6076 rundll32.exe Token: 34 6076 rundll32.exe Token: 35 6076 rundll32.exe Token: SeDebugPrivilege 4332 tasklist.exe Token: SeDebugPrivilege 5432 tasklist.exe Token: SeDebugPrivilege 1604 tasklist.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6076 rundll32.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 6076 wrote to memory of 5596 6076 rundll32.exe 90 PID 6076 wrote to memory of 1964 6076 rundll32.exe 94 PID 1964 wrote to memory of 6104 1964 cmd.exe 96 PID 6104 wrote to memory of 4332 6104 cmd.exe 97 PID 6104 wrote to memory of 1884 6104 cmd.exe 98 PID 6104 wrote to memory of 1556 6104 cmd.exe 99 PID 6104 wrote to memory of 5432 6104 cmd.exe 101 PID 6104 wrote to memory of 4968 6104 cmd.exe 102 PID 6104 wrote to memory of 2376 6104 cmd.exe 103 PID 6104 wrote to memory of 1604 6104 cmd.exe 104 PID 6104 wrote to memory of 4552 6104 cmd.exe 105 PID 6104 wrote to memory of 4424 6104 cmd.exe 106 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\323f6232ce475bf0fd9812a5fbdef194aaf7c4eb01854749500a9bc0bb09c02a.dll,#11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5596
-
-
C:\Windows\system32\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Public\Public_Release\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.bAt2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\cmd.execmd /C C:\Users\Public\Public_Release\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.bAt3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\system32\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
C:\Windows\system32\find.exeFIND /I "rundll32.exe"4⤵PID:1884
-
-
C:\Windows\system32\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- Delays execution with timeout.exe
PID:1556
-
-
C:\Windows\system32\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:5432
-
-
C:\Windows\system32\find.exeFIND /I "rundll32.exe"4⤵PID:4968
-
-
C:\Windows\system32\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- Delays execution with timeout.exe
PID:2376
-
-
C:\Windows\system32\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV4⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\system32\find.exeFIND /I "rundll32.exe"4⤵PID:4552
-
-
C:\Windows\system32\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- Delays execution with timeout.exe
PID:4424
-
-
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵
- Executes dropped EXE
PID:4308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\Public_Release\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.bAt
- Size 1KB
- SHA256 b2e883c054777eea0b7d731df9ff3be5babb57b1e0af1ce2be5c9914ebcfe7c9
- MD5 62139865926fa4bb96356fff1bb999df
- SHA1 1269903003d9e58710670cee84477d9645fd4517
- SHA512 1d89da43eaf30937e129769f68efd42526953452304e5e011d6d4bb817622f2a611b1bff51226ef350eb3429abd420332138de9ad78645601ba3e37016d8a8e4
- TLSH T1DD31DC9FC8234D2C031406EB234ACC5BC690F057EEC531A0B0A82B992396E9D0966BFD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\rundll32.exe
- Size 88KB
- SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
- MD5 025b13bf5652712d9b596e6766a9c386
- SHA1 def4011b5536983285472ba75c22c6a2410edf6a
- SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
- SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
- TLSH T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
- MD5 SHA1 SHA512 SSDEEP TLSH