Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0db00a5a7b10ec80bc53fc5cd63f9dfb710b354d60b9d6b58a5bb9a10f1765a.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0db00a5a7b10ec80bc53fc5cd63f9dfb710b354d60b9d6b58a5bb9a10f1765a.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target c0db00a5a7b10ec80bc53fc5cd63f9dfb710b354d60b9d6b58a5bb9a10f1765a.dll
- Size 5.4MB
- Sample261012-rxgfjsxsa1
- SHA256 c0db00a5a7b10ec80bc53fc5cd63f9dfb710b354d60b9d6b58a5bb9a10f1765a
- MD5 930dc108a46888da5fbdc1b7837b0953
- SHA1 0d0c8a73cb719796f5d0d640eb8a034be26cbd20
- SHA512 5dfffb209059126f7eacc32648c25178cbe6a05e597c546a2aa7118597ccadfee0c6cc727825a13fc54f7bdfb76d73e75eb952c44b97c1dfd7284924648b4180
- SSDEEP 98304:3kQS2X51zWrXHakhmkk59RqgQA1rdWJQdrz55xpO9K8:3kuJYekckWSglBkQdrz55PR8
- TLSH T1B746C00BAAF881BAC876D039C6574AAFD7F274010531A65F57910B192F73B229F2F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 7 IoCs
resource yara_rule behavioral2/memory/4412-33-0x000002CBA70A0000-0x000002CBA7109000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4412-34-0x000002CBA7210000-0x000002CBA7280000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4412-36-0x000002CBA7210000-0x000002CBA7280000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4412-38-0x000002CBA7210000-0x000002CBA7280000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4412-39-0x000002CBA7210000-0x000002CBA7280000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4412-40-0x000002CBA7210000-0x000002CBA7280000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4412-74-0x000002CBA7210000-0x000002CBA7280000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 4412 rundll32.exe 9 4412 rundll32.exe 10 4412 rundll32.exe 11 4412 rundll32.exe 12 4412 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 3800 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Q: rundll32.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com 10 api.ipify.org 1 api.ipify.org - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\crclIEnt.DlL rundll32.exe File opened for modification C:\Windows\system32\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4844 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe 4412 rundll32.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 4412 rundll32.exe Token: SeLoadDriverPrivilege 4412 rundll32.exe Token: SeTakeOwnershipPrivilege 4412 rundll32.exe Token: SeIncBasePriorityPrivilege 4412 rundll32.exe Token: SeTcbPrivilege 4412 rundll32.exe Token: SeDebugPrivilege 4412 rundll32.exe Token: SeCreateTokenPrivilege 4412 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 4412 rundll32.exe Token: SeLockMemoryPrivilege 4412 rundll32.exe Token: SeIncreaseQuotaPrivilege 4412 rundll32.exe Token: SeMachineAccountPrivilege 4412 rundll32.exe Token: SeTcbPrivilege 4412 rundll32.exe Token: SeSecurityPrivilege 4412 rundll32.exe Token: SeTakeOwnershipPrivilege 4412 rundll32.exe Token: SeLoadDriverPrivilege 4412 rundll32.exe Token: SeSystemProfilePrivilege 4412 rundll32.exe Token: SeSystemtimePrivilege 4412 rundll32.exe Token: SeProfSingleProcessPrivilege 4412 rundll32.exe Token: SeIncBasePriorityPrivilege 4412 rundll32.exe Token: SeCreatePagefilePrivilege 4412 rundll32.exe Token: SeCreatePermanentPrivilege 4412 rundll32.exe Token: SeBackupPrivilege 4412 rundll32.exe Token: SeRestorePrivilege 4412 rundll32.exe Token: SeShutdownPrivilege 4412 rundll32.exe Token: SeDebugPrivilege 4412 rundll32.exe Token: SeAuditPrivilege 4412 rundll32.exe Token: SeSystemEnvironmentPrivilege 4412 rundll32.exe Token: SeChangeNotifyPrivilege 4412 rundll32.exe Token: SeRemoteShutdownPrivilege 4412 rundll32.exe Token: SeUndockPrivilege 4412 rundll32.exe Token: SeSyncAgentPrivilege 4412 rundll32.exe Token: SeEnableDelegationPrivilege 4412 rundll32.exe Token: SeManageVolumePrivilege 4412 rundll32.exe Token: SeImpersonatePrivilege 4412 rundll32.exe Token: SeCreateGlobalPrivilege 4412 rundll32.exe Token: 31 4412 rundll32.exe Token: 32 4412 rundll32.exe Token: 33 4412 rundll32.exe Token: 34 4412 rundll32.exe Token: 35 4412 rundll32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4412 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4844 4412 rundll32.exe 91 PID 4844 wrote to memory of 2516 4844 cmd.exe 92 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0db00a5a7b10ec80bc53fc5cd63f9dfb710b354d60b9d6b58a5bb9a10f1765a.dll,#11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRClient.dll",EBWebView "C:\Windows\system32\rundll32.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRClient.dll",EBWebView "C:\Windows\system32\rundll32.exe"3⤵PID:2516
-
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵
- Executes dropped EXE
PID:3800
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\49'`+{''#&%)!)23\25(%]{'@^@.38
- Size 91KB
- SHA256 46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e
- MD5 d751a1ebc49ecd3ce75ef683878057db
- SHA1 8887fc3afcdf48721312d8df9865c6c8234b8614
- SHA512 f0565d8b7c92877327bc8939cf09d21010dbb0498200f358f7d060ae70839a2349a0a2bc6d080be531400b47529d5e7fe0e7a425929096e22c77760f8a498e4d
- SSDEEP 1536:AtFSIfIlTfynQGkaeEa69TXdZSip9M+PccXX6G+2+z2q:pIfIlT6QGK69TrDDMSzX+2+2q
- TLSH T1CF935B83D35615C6D6AACAB9C1AA9223EF71BC09172553CF4E60B6501F32FE19F39306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\49'`+{''#&%)!)23\25(%]{'@^@.38.mui
- Size 91KB
- SHA256 a6ba29b7fbd5607dcac8997e0c8fc8dc6d4dbf44071c8773c21baebe4a16b9fd
- MD5 ef568b1b719d62798a342b57a87f10e0
- SHA1 c1168f8ef6bd344211b5b7b7fc58712c270afbfe
- SHA512 fece987b13a47ce7e680c8ac4e5d93b082896c574d32e2b33758a5f2bef114d0307941635c1a8ed42eb0543060749f0d1811f6a8b5a3533328b4de8d3a33ba0b
- SSDEEP 1536:QPWf08vyyD7plj/FbJ/JJKLACmBWoJ6n+LrA0PbSxXe76OmVuvkQPPg0mAMgvijq:dhf7pN/F1/JJKL9mBpTBzX6OmVuvkQPN
- TLSH T1A69312C5181A33170CBB9CF1172AE43A6B71F2518B14BBE63F29B775AF1A11C95B7820
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\49'`+{''#&%)!)23\68],['[)&,.83
- Size 16KB
- SHA256 9f326ede322930a7d5e149fa8720802b0623c1972dc54e41a2a73608fb6810dd
- MD5 630c1751ae29f3e1a127afcbcfa7c4d7
- SHA1 1583390bdd47357cf81d116d449f882b908348cb
- SHA512 35dddba42e5e10f32ce122021ea92f8df347df6b968cc1d153b77516c83231c5dc7cec6861a94fe06150a310ede8c84d553f6372615a3f2de902fec93727f8ed
- SSDEEP 192:rvuYacCCpQIw9l0Hnos0jWGxIHnYe+PjP8srcQqwBjtlAnfOnJa:7uoCCpQIY0Hnos0bIHnYPL1tqOUnH
- TLSH T185724B8B4719305AFAD7CA75C2B6866BEC31BAD0A7560AFF0155C1911E81FE05B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\49'`+{''#&%)!)23\68],['[)&,.83.mui
- Size 16KB
- SHA256 0cb31469a94a7c3c9d69a3a3f91750986c1387196b4516462ecf72200877ea3f
- MD5 8513d7624ac6810807fe7684dd97d6f0
- SHA1 caf236f4fdc2eea3e8e4ce3c7f2d3ea1af87deef
- SHA512 50cf1db574089fe45122e0415571007ad36c28066e50f9a5e3e839426e87518d24628061122f8f6f1266708ce390cc40b861638a404ab09c5dbc0f56031d093c
- SSDEEP 384:QyHTVrBIEnvooYvRmCkyXT5TbL+oS0q/pgTMmqxd6WRK1vnlZDY4nD:QqT1BIEvo9RmCkyXT5nWb/pgImGfYNlr
- TLSH T19372D14F25DF24C9AB8D7A2D34FA26D8F6463B840688C85BF1AFC57072C81874BB64D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\rundll32.exe
- Size 88KB
- SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
- MD5 025b13bf5652712d9b596e6766a9c386
- SHA1 def4011b5536983285472ba75c22c6a2410edf6a
- SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
- SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
- TLSH T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
- MD5 SHA1 SHA512 SSDEEP TLSH