Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 11:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ValorHack.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
ValorHack.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target ValorHack.exe
- Size 43KB
- Sample260910-npbzbawtbs
- SHA256 22105237aff792d80b0e3f92586294fc3f42a9dd0334fa7c4c22e404848e03a4
- MD5 ea5eefca15c94c75ca7d1781682876bf
- SHA1 8d07aae293f006b2d36ec0791fc338c78bc142e6
- SHA512 808da11d886b1b92899eef01b011a4069cc595d1c402d9999045445e0f0fa3f056ad0020d63c7e0f9f80af5a6f0be98b32147eb0e3a4f393716f81e0b537fccc
- SSDEEP 768:xm3km2qDNI9uZEqBsQpcjjx5kmLZFX+WpE2dadmj4+2pl+wIhwwVK:I3kmlNmuZywcjlHdFFEzmj4x+wY
- TLSH T16D13E19BB8A478A6DB6C8CF31C331970C788657682090E537B435DD247E15EBC66568C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 6920 steam.exe 4260 ArticTech.exe 3212 steam.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ArticTech.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language steam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ValorHack.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe 6920 steam.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4652 wrote to memory of 6920 4652 ValorHack.exe 90 PID 4652 wrote to memory of 4260 4652 ValorHack.exe 92 PID 4260 wrote to memory of 3212 4260 ArticTech.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\ValorHack.exe"C:\Users\Admin\AppData\Local\Temp\ValorHack.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\steam.exe"C:\Users\Admin\AppData\Local\Temp\steam.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6920
-
-
C:\Users\Admin\AppData\Local\Temp\ArticTech.exe"C:\Users\Admin\AppData\Local\Temp\ArticTech.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\steam.exe"C:\Users\Admin\AppData\Local\Temp\steam.exe"3⤵
- Executes dropped EXE
PID:3212
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ArticTech.exe
- Size 23KB
- SHA256 71eeefb525023be091b7bc8e26d46be25f2bb7bef31fbcaa3e208165e7829345
- MD5 980506d8ff931783370341c8a655be42
- SHA1 14519bb800d6821198ca8f93c59ed57ecbee7715
- SHA512 e7449608df5b99339c0f6449735342a672fcb906426b276d99579ff2f2c2eea55f0e5948e9b86712aefeb52c56c227ca968ef1f174881f7f45b57766980bb55f
- SSDEEP 384:CmsCXkm2fSDQJp4KI9/Gj9jA+hGy5TAb6sQpcjmWvhx5Qfm59ZFR5D+xM+z:Cm3km2qDYI9uZEqBsQpcjjx5kmLZFX+h
- TLSH T1B9B2B08BB8E568E3D6189EB2482319E0CF9C5873D3440A27FB431DE587F059ACA3E14D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\steam.exe
- Size 23KB
- SHA256 aadd255a8efe2491b29c1d5917f72db3eea93ffde89995985a19d0d4c172213c
- MD5 afe9b68ed167f0ec45a28bd47d3054f7
- SHA1 bd07d119f7cc88573d864d68aa3d3612fcbbea9f
- SHA512 657c69fa4ddc7a609d22f7e0a10911103177197a56a69d3c9d9461d8e8db6ca732c315e4b1f1bbb0934b6dee29574e569a381b02e3c3f40b6e392eb7b1659349
- SSDEEP 384:A7nM/ItPc+pYsyKVzg6VvYxIP4Ztd6TTjuJtzwoF8BqbRZoXC6P+lK9vF907LaFy:psZWTJ2qaUR+XDP+lK9v47ya5z
- TLSH T1F4B23B337A168276D6A645B10839FFAA82BFA5305F7116D7FB818D2E0A705D1ED3240B
- MD5 SHA1 SHA512 SSDEEP TLSH