Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3a6bb2e83f4c58a4ed5fcb512a8e7e1fe5a65b6fd1888454b054ce83b78a23a.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3a6bb2e83f4c58a4ed5fcb512a8e7e1fe5a65b6fd1888454b054ce83b78a23a.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target d3a6bb2e83f4c58a4ed5fcb512a8e7e1fe5a65b6fd1888454b054ce83b78a23a.dll
- Size 5.8MB
- Sample261014-ps5aps119k
- SHA256 d3a6bb2e83f4c58a4ed5fcb512a8e7e1fe5a65b6fd1888454b054ce83b78a23a
- MD5 9aeb45c74d46d85c1db68a9e925fc679
- SHA1 438d474bc707f783f0731e3236432f1186f0ee47
- SHA512 5699ccf5554ef207bfd33348c9c0bc72810bc74b2abbe72b3d74886d5515e06c64ecdcc4c374c7f30010ff8975406e4885f900ca9716cadcdadc932fedb58f2e
- SSDEEP 98304:djBty0g5LwR3Xv7lfl4K6z0ShZaLQ2RC6cwmU3E1my7N0OF:djBtnvBz4hZgQ2oiFuD7
- TLSH T11156CF577AF840BAC8A3C179C66B8A9FE3F274110D31961F9295474A6F37B61CE0B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 8 IoCs
resource yara_rule behavioral2/memory/4632-15-0x000001FBBBC80000-0x000001FBBBCE9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4632-16-0x000001FBBBE00000-0x000001FBBBE70000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4632-17-0x000001FBBBE00000-0x000001FBBBE70000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4632-18-0x000001FBBBE00000-0x000001FBBBE70000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4632-20-0x000001FBBBE00000-0x000001FBBBE70000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4632-21-0x000001FBBBE00000-0x000001FBBBE70000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4632-22-0x000001FBBBE00000-0x000001FBBBE70000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4632-47-0x000001FBBBE00000-0x000001FBBBE70000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 4632 rundll32.exe 9 4632 rundll32.exe 10 4632 rundll32.exe 11 4632 rundll32.exe 12 4632 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 936 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 ip-api.com 10 api.ipify.org - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\CrCliEnT.Dll rundll32.exe File opened for modification C:\Windows\system32\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4936 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe 4632 rundll32.exe - Suspicious behavior: LoadsDriver 47 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 4632 rundll32.exe Token: SeLoadDriverPrivilege 4632 rundll32.exe Token: SeTakeOwnershipPrivilege 4632 rundll32.exe Token: SeIncBasePriorityPrivilege 4632 rundll32.exe Token: SeTcbPrivilege 4632 rundll32.exe Token: SeDebugPrivilege 4632 rundll32.exe Token: SeCreateTokenPrivilege 4632 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 4632 rundll32.exe Token: SeLockMemoryPrivilege 4632 rundll32.exe Token: SeIncreaseQuotaPrivilege 4632 rundll32.exe Token: SeMachineAccountPrivilege 4632 rundll32.exe Token: SeTcbPrivilege 4632 rundll32.exe Token: SeSecurityPrivilege 4632 rundll32.exe Token: SeTakeOwnershipPrivilege 4632 rundll32.exe Token: SeLoadDriverPrivilege 4632 rundll32.exe Token: SeSystemProfilePrivilege 4632 rundll32.exe Token: SeSystemtimePrivilege 4632 rundll32.exe Token: SeProfSingleProcessPrivilege 4632 rundll32.exe Token: SeIncBasePriorityPrivilege 4632 rundll32.exe Token: SeCreatePagefilePrivilege 4632 rundll32.exe Token: SeCreatePermanentPrivilege 4632 rundll32.exe Token: SeBackupPrivilege 4632 rundll32.exe Token: SeRestorePrivilege 4632 rundll32.exe Token: SeShutdownPrivilege 4632 rundll32.exe Token: SeDebugPrivilege 4632 rundll32.exe Token: SeAuditPrivilege 4632 rundll32.exe Token: SeSystemEnvironmentPrivilege 4632 rundll32.exe Token: SeChangeNotifyPrivilege 4632 rundll32.exe Token: SeRemoteShutdownPrivilege 4632 rundll32.exe Token: SeUndockPrivilege 4632 rundll32.exe Token: SeSyncAgentPrivilege 4632 rundll32.exe Token: SeEnableDelegationPrivilege 4632 rundll32.exe Token: SeManageVolumePrivilege 4632 rundll32.exe Token: SeImpersonatePrivilege 4632 rundll32.exe Token: SeCreateGlobalPrivilege 4632 rundll32.exe Token: 31 4632 rundll32.exe Token: 32 4632 rundll32.exe Token: 33 4632 rundll32.exe Token: 34 4632 rundll32.exe Token: 35 4632 rundll32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4632 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4632 wrote to memory of 4936 4632 rundll32.exe 90 PID 4936 wrote to memory of 5204 4936 cmd.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a6bb2e83f4c58a4ed5fcb512a8e7e1fe5a65b6fd1888454b054ce83b78a23a.dll,#11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"3⤵PID:5204
-
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵
- Executes dropped EXE
PID:936
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1)!`(^,#&@%3\4}['},!'.495
- Size 16KB
- SHA256 d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f
- MD5 50390455e92fb62cbe6a89dbb61037c2
- SHA1 b02ad9271e5410dfd7edd03d50469997ea54a8b2
- SHA512 f6dac88336489b81361eae5c47caadfb182c55213af51fc7d9fc6132380be9de8a06b598a1027b7c17952657bc0a334ef68a40284452e127290fd13536f4b31e
- SSDEEP 192:fvuYacCCpQIw9l0Hvs0MI1xaTnYe+PjP8srcQqwBjtlAO5gXUE:3uoCCpQIY0Hvs0MqaTnYPL1tqOUO5gz
- TLSH T14A723B8B471930AAFAD7CA75D2B6867BEC30BAD0A76605FF0165C1910E81FE05B3D319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1)!`(^,#&@%3\4}['},!'.495.miUI
- Size 16KB
- SHA256 fb27ba66d9b60925875097f31372e60a7da42a61aad2f299bbf04f00ab7049ca
- MD5 4429ece903542863e32ce6088e9560ff
- SHA1 f47c8f38a71c32bc25c3bee8c2acb2ef1f2b7fd0
- SHA512 d0270517916635b0df19579892eaaaa3e43e06a82ae479d96c44b6de9ad61ee0b711da119512bb5b550c82ea1ff9d3b66f37411e9881b5e128e3db9402cba63b
- SSDEEP 384:y7blygX0tYIJDb4CRpZC8zgrgIidn5yQF2Q9HpeHbRvqBp:khP0t5B8oZCYP5Y2FkHVyL
- TLSH T1DE72D0CDF412358CB9CA25115389ED14341580E9BC28F8B689DF4D4AB8D92DDFDA2E62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\rundll32.exe
- Size 88KB
- SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
- MD5 025b13bf5652712d9b596e6766a9c386
- SHA1 def4011b5536983285472ba75c22c6a2410edf6a
- SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
- SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
- TLSH T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
- MD5 SHA1 SHA512 SSDEEP TLSH