Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 21:30
Behavioral task
behavioral1
Sample
2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe
- Size 376KB
- Sample260910-1cj6dayvht
- SHA256 a7b601f4d4438f890c002d2a003d0e2e7f14a2a47f3cda171b294830ff3f5f5f
- MD5 f58c85932b71ec76b3dcea10c4a6520f
- SHA1 2f48a5be5dcae96b337991e6329bf054e11d3f2d
- SHA512 0a4b258f9203ce1c813a57e43e82d8b66169674dabfe6604feae86f6f50f83689cc79b23e216036fcb95507a0d8613a1a84f2d49a54dd554b79150d509009ce1
- SSDEEP 6144:AHdhPDjUVFPeDADETZZX+t4Z0dS7jNt5z1GExQol0XAD35m0ampO83rvdcp:AzDQL2iqjNeKQG5+YV
- TLSH T1B1848C1772E850F6D9668239C9A38A06FB73781607209B8F17A4477A1F237D1BD3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 8 IoCs
resource yara_rule behavioral2/memory/4244-1-0x0000023377A60000-0x0000023377A9C000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4244-2-0x0000023377DD0000-0x0000023377E12000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4244-3-0x0000023377DD0000-0x0000023377E12000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4244-4-0x0000023377DD0000-0x0000023377E12000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4244-5-0x0000023377DD0000-0x0000023377E12000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4244-9-0x0000023377DD0000-0x0000023377E12000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4244-10-0x0000023377DD0000-0x0000023377E12000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4244-11-0x0000023377DD0000-0x0000023377E12000-memory.dmp family_valleyrat_stage_2_v2 - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: tracerpt.exe File opened (read-only) \??\L: tracerpt.exe File opened (read-only) \??\P: tracerpt.exe File opened (read-only) \??\R: tracerpt.exe File opened (read-only) \??\Z: tracerpt.exe File opened (read-only) \??\O: tracerpt.exe File opened (read-only) \??\Q: tracerpt.exe File opened (read-only) \??\G: tracerpt.exe File opened (read-only) \??\H: tracerpt.exe File opened (read-only) \??\M: tracerpt.exe File opened (read-only) \??\S: tracerpt.exe File opened (read-only) \??\T: tracerpt.exe File opened (read-only) \??\W: tracerpt.exe File opened (read-only) \??\U: tracerpt.exe File opened (read-only) \??\V: tracerpt.exe File opened (read-only) \??\X: tracerpt.exe File opened (read-only) \??\Y: tracerpt.exe File opened (read-only) \??\D: tracerpt.exe File opened (read-only) \??\I: tracerpt.exe File opened (read-only) \??\J: tracerpt.exe File opened (read-only) \??\K: tracerpt.exe File opened (read-only) \??\N: tracerpt.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3340 set thread context of 4244 3340 2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe 89 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe 4244 tracerpt.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4244 tracerpt.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4244 tracerpt.exe Token: SeDebugPrivilege 4244 tracerpt.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4244 tracerpt.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3340 wrote to memory of 4244 3340 2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe 89 PID 3340 wrote to memory of 4244 3340 2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe 89 PID 4244 wrote to memory of 472 4244 tracerpt.exe 91 PID 4244 wrote to memory of 472 4244 tracerpt.exe 91 PID 4244 wrote to memory of 472 4244 tracerpt.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\System32\tracerpt.exe"C:\Windows\System32\tracerpt.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe3⤵PID:472
-
-