Analysis
- max time kernel
298s - max time network
288s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 18:02
General
- Target ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្.exe
- Size 2.1MB
- Sample261017-wmf49axvbx
- SHA256 537230534fae312b4d1247ed4987990bb2cae9c71affb9bf041ce43cb7066554
Malware Config
Extracted
-
valleyrat_s2
-
203.91.74.177:6677
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 6 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 9 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្.exe"C:\Users\Admin\AppData\Local\Temp\ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramLog\Windows\AppData\Log\Setp.exe"C:\ProgramLog\Windows\AppData\Log\Setp.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c C:\ProgramLog\Windows\AppData\Log\123.bat3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\ProgramLog\Windows\AppData\Log\123.bat4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'C:\ProgramLog\Windows\AppData\Log\1.zip' -DestinationPath 'C:\ProgramLog\Windows\AppData\Log\' -Force"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'C:\ProgramLog\Windows\AppData\Log\2.zip' -DestinationPath 'C:\ProgramLog\Windows\AppData\Log\' -Force"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramLog\Windows\AppData\Log\TGFile.exe"C:\ProgramLog\Windows\AppData\Log\TGFile.exe" "1.txt"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c cd /d "C:\ProgramLog\Windows\AppData\Log\" && "C:\ProgramLog\Windows\AppData\Log\TGFile.exe" hide.log6⤵
- Executes a command shell one-liner
-
C:\ProgramLog\Windows\AppData\Log\TGFile.exe"C:\ProgramLog\Windows\AppData\Log\TGFile.exe" hide.log7⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.txt
1.zip
123.bat
2.zip
Setp.exe
TGFile.exe
VCRUNTIME140.dll
hide.log
libepsbase.dll
lua51.dll
msvcr100.dll
set.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hrot2pq1.lmn.ps1
memory/896-68-0x000001325B060000-0x000001325B06A000-memory.dmp
memory/896-67-0x000001325B140000-0x000001325B152000-memory.dmp
memory/896-66-0x000001325B140000-0x000001325B14A000-memory.dmp
memory/896-65-0x000001325B080000-0x000001325B132000-memory.dmp
memory/896-64-0x000001325B060000-0x000001325B07E000-memory.dmp
memory/896-56-0x0000013242840000-0x0000013242862000-memory.dmp
memory/5448-125-0x00007FFCC3250000-0x00007FFCC3260000-memory.dmp
memory/5448-128-0x00007FFCC3250000-0x00007FFCC3260000-memory.dmp
memory/5448-126-0x00007FFCC3250000-0x00007FFCC3260000-memory.dmp
memory/5448-129-0x00007FFCC3250000-0x00007FFCC3260000-memory.dmp
memory/5448-127-0x00007FFCC3250000-0x00007FFCC3260000-memory.dmp
memory/5448-130-0x00007FFCC3250000-0x00007FFCC3260000-memory.dmp
memory/5448-131-0x0000000002B10000-0x0000000002B5F000-memory.dmp
memory/5448-133-0x0000000180000000-0x0000000180056000-memory.dmp
memory/5448-140-0x0000000180000000-0x0000000180056000-memory.dmp
memory/5448-139-0x0000000180000000-0x0000000180056000-memory.dmp
memory/5448-144-0x0000000180000000-0x0000000180056000-memory.dmp
memory/5448-145-0x0000000180000000-0x0000000180056000-memory.dmp