Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/09/2026, 05:45
General
- Target F89A414276E136A36BDA7952CA8F6BE2.exe
- Size 692KB
- Sample260911-gfxfbsstft
- SHA256 aff88ff4d9ea55fdab0b75966cdf8eea13c3d511e0d00df29f9f57768db193e3
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
134.122.155.220:443
-
134.122.155.220:80
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F89A414276E136A36BDA7952CA8F6BE2.exe"C:\Users\Admin\AppData\Local\Temp\F89A414276E136A36BDA7952CA8F6BE2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\###.exe"C:\###.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe shell:::{3CD1F936-70F7-495B-B743-B0BD5273C535}3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\~sys_25385.sysC:\Users\Admin\AppData\Local\Temp\~sys_25385.sys1⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SvcHostLoader\SvcHostLoader.exe"C:\ProgramData\SvcHostLoader\SvcHostLoader.exe" -onlyctrl2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SvcHostLoader\SvcHostLoader.exeC:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
-
C:\ProgramData\SvcHostLoader\SvcHostLoader.exe"C:\ProgramData\SvcHostLoader\SvcHostLoader.exe" -onlyctrl1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SvcHostLoader\SvcHostLoader.exeC:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
###.exe
~sys_25385.sys
memory/1960-40-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-98-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-26-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-25-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-28-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-30-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-29-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-32-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-34-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-33-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-36-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-106-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-102-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-39-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-65-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-97-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-105-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-94-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-44-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-90-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-89-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-86-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-81-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-82-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-78-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-73-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-57-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-58-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-74-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-20-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-62-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-70-0x0000000140000000-0x000000014002A000-memory.dmp
memory/1960-66-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-59-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-68-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-67-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-64-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-72-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-60-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-56-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-75-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-76-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-53-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-80-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-54-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-52-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-83-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-84-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-49-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-88-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-50-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-48-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-91-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-92-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-45-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-96-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-46-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-42-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-100-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-99-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-37-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-104-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-38-0x0000000140000000-0x000000014002A000-memory.dmp
memory/4492-24-0x0000000140000000-0x000000014002A000-memory.dmp