valleyrat_s2 | a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77

Analysis

max time kernel
26s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Tax Filing Regulations.exe
Size 367KB
Sample261014-pmesvsvwev
SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
MD5 d455b3b0529d73929fb2f2ecd43b4f75
SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
TLSH
T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation ransomware

Malware Config

Extracted

Family

valleyrat_s2

Version

8.210.231.207:9090
8.210.231.207:6666

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 8 IoCs

resource	yara_rule
behavioral2/memory/2536-105-0x00000000064E0000-0x0000000006542000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2536-130-0x00000000064E0000-0x0000000006542000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2536-176-0x00000000096B0000-0x0000000009712000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2536-203-0x00000000096B0000-0x0000000009712000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2536-251-0x0000000009720000-0x0000000009782000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2536-275-0x0000000009720000-0x0000000009782000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2536-326-0x000000000A460000-0x000000000A4C2000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2536-353-0x000000000A460000-0x000000000A4C2000-memory.dmp	family_valleyrat_stage_2_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 51 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3952	powershell.exe
3828	powershell.exe
5436	powershell.exe
5716	powershell.exe
4756	powershell.exe
1132	powershell.exe
5984	powershell.exe
5644	powershell.exe
4140	powershell.exe
3632	powershell.exe
4928	powershell.exe
2720	powershell.exe
4128	powershell.exe
1824	powershell.exe
2764	powershell.exe
1620	powershell.exe
240	powershell.exe
3152	powershell.exe
4680	powershell.exe
6080	powershell.exe
5492	powershell.exe
1568	powershell.exe
1004	powershell.exe
4472	powershell.exe
2696	powershell.exe
4472	powershell.exe
1264	powershell.exe
3436	powershell.exe
2468	powershell.exe
4204	powershell.exe
4756	powershell.exe
2520	powershell.exe
4072	powershell.exe
3364	powershell.exe
4416	powershell.exe
2372	powershell.exe
4596	powershell.exe
1228	powershell.exe
2140	powershell.exe
3604	powershell.exe
1132	powershell.exe
1748	powershell.exe
1488	powershell.exe
4152	powershell.exe
4104	powershell.exe
5056	powershell.exe
4516	powershell.exe
3976	powershell.exe
1496	powershell.exe
4680	powershell.exe
2676	powershell.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	Process not Found
File opened (read-only)	\??\R:	Process not Found
File opened (read-only)	\??\T:	Process not Found
File opened (read-only)	\??\W:	Process not Found
File opened (read-only)	\??\X:	Process not Found
File opened (read-only)	\??\Y:	Process not Found
File opened (read-only)	\??\Z:	Process not Found
File opened (read-only)	\??\D:	Process not Found
File opened (read-only)	\??\H:	Process not Found
File opened (read-only)	\??\L:	Process not Found
File opened (read-only)	\??\M:	Process not Found
File opened (read-only)	\??\V:	Process not Found
File opened (read-only)	\??\B:	Process not Found
File opened (read-only)	\??\G:	Process not Found
File opened (read-only)	\??\I:	Process not Found
File opened (read-only)	\??\K:	Process not Found
File opened (read-only)	\??\S:	Process not Found
File opened (read-only)	\??\J:	Process not Found
File opened (read-only)	\??\N:	Process not Found
File opened (read-only)	\??\O:	Process not Found
File opened (read-only)	\??\P:	Process not Found
File opened (read-only)	\??\U:	Process not Found

Executes dropped EXE 1 IoCs

pid	Process
4764	22ml413b.exe

Loads dropped DLL 1 IoCs

pid	Process
4764	22ml413b.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
5904	New Tax Filing Regulations.exe
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found
2536	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	Process not Found

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5904	New Tax Filing Regulations.exe
4764	22ml413b.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeShutdownPrivilege	2536	Process not Found
Token: SeCreatePagefilePrivilege	2536	Process not Found
Token: SeIncreaseQuotaPrivilege	3976	powershell.exe
Token: SeSecurityPrivilege	3976	powershell.exe
Token: SeTakeOwnershipPrivilege	3976	powershell.exe
Token: SeLoadDriverPrivilege	3976	powershell.exe
Token: SeSystemProfilePrivilege	3976	powershell.exe
Token: SeSystemtimePrivilege	3976	powershell.exe
Token: SeProfSingleProcessPrivilege	3976	powershell.exe
Token: SeIncBasePriorityPrivilege	3976	powershell.exe
Token: SeCreatePagefilePrivilege	3976	powershell.exe
Token: SeBackupPrivilege	3976	powershell.exe
Token: SeRestorePrivilege	3976	powershell.exe
Token: SeShutdownPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeSystemEnvironmentPrivilege	3976	powershell.exe
Token: SeRemoteShutdownPrivilege	3976	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	Process not Found

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3460	2536	Process not Found
PID 2536 wrote to memory of 2372	2536	Process not Found	92
PID 2536 wrote to memory of 3976	2536	Process not Found	95
PID 2536 wrote to memory of 4204	2536	Process not Found	97
PID 2536 wrote to memory of 3604	2536	Process not Found	141
PID 2536 wrote to memory of 4756	2536	Process not Found	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\New Tax Filing Regulations.exe
"C:\Users\Admin\AppData\Local\Temp\New Tax Filing Regulations.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5904

C:\ProgramData\EdgeUpdate\qoa4i2ua\22ml413b.exe
C:\ProgramData\EdgeUpdate\qoa4i2ua\22ml413b.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:4764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4756

C:\ProgramData\EdgeUpdate\vcxarl2i\m1x63mna.exe
C:\ProgramData\EdgeUpdate\vcxarl2i\m1x63mna.exe
1⤵
PID:4872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1748

C:\ProgramData\EdgeUpdate\vicflxax\aum74vcc.exe
C:\ProgramData\EdgeUpdate\vicflxax\aum74vcc.exe
1⤵
PID:6120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1488

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2696

C:\ProgramData\EdgeUpdate\greaajmi\rk7vefc0.exe
C:\ProgramData\EdgeUpdate\greaajmi\rk7vefc0.exe
1⤵
PID:5484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1496

C:\ProgramData\EdgeUpdate\1pvonzxl\1biiu5wf.exe
C:\ProgramData\EdgeUpdate\1pvonzxl\1biiu5wf.exe
1⤵
PID:3604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5056

C:\ProgramData\EdgeUpdate\j9ei1z2w\8wvsj0yy.exe
C:\ProgramData\EdgeUpdate\j9ei1z2w\8wvsj0yy.exe
1⤵
PID:1088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5436

C:\ProgramData\EdgeUpdate\6wla9pbt\r3fu40sm.exe
C:\ProgramData\EdgeUpdate\6wla9pbt\r3fu40sm.exe
1⤵
PID:2576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4928

C:\ProgramData\EdgeUpdate\seqpe2cl\hrc8zxh2.exe
C:\ProgramData\EdgeUpdate\seqpe2cl\hrc8zxh2.exe
1⤵
PID:4612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5716

C:\ProgramData\EdgeUpdate\o0l6kqvp\zfxj7tn0.exe
C:\ProgramData\EdgeUpdate\o0l6kqvp\zfxj7tn0.exe
1⤵
PID:6104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3364

C:\ProgramData\EdgeUpdate\65bojr55\9styzsgp.exe
C:\ProgramData\EdgeUpdate\65bojr55\9styzsgp.exe
1⤵
PID:3036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5492

C:\ProgramData\EdgeUpdate\brkrnprv\t7mf4qzf.exe
C:\ProgramData\EdgeUpdate\brkrnprv\t7mf4qzf.exe
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22ml413b.exe

Path C:\ProgramData\EdgeUpdate\qoa4i2ua\22ml413b.exe
Size 367KB
SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
MD5 d455b3b0529d73929fb2f2ecd43b4f75
SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
TLSH
T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.log

Path C:\ProgramData\EdgeUpdate\qoa4i2ua\config.log
Size 360KB
SHA256 c728b54b4d4db18f2b0fa3426f12bd9006b9f8d7d58cc5c87726a360da2cc6bc
MD5 10cc04f3ce7c1155563733a354ba0c26
SHA1 6bfff5848cb67224af2f60bbf20d1f43f89ae3f1
SHA512 f75d99383e8ea348fc4eebbccb3224c1af4e2ccaa8a1a0050391abd2ffb4ec270da0194cf041bdc954330b3d765aadbf41d52815a5d7e76741e8b0332c148c1d
SSDEEP 6144:7GodlAxieZT7oDPAWy+jBT4+TrFO9PL02Lk5rX:yt7oD1BX5O502Y
TLSH
T15E747C15F7A544A9E177C17CC9638916EB727C4503A0EBEF13A04A993F33BE0A639712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download