Analysis
- max time kernel
74s - max time network
423s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 05:43
General
- Target Open_to_view.exe
- Size 25KB
- Sample261020-getcaavy9l
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.243.109.132:5252
-
campaign_date
20261019
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe"C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe"1⤵
- Direct Volume Access: Opens a physical disk for reading
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\ProgramData\EdgeUpdate\8kqxixlb\ycog5n5p.exeC:\ProgramData\EdgeUpdate\8kqxixlb\ycog5n5p.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
ycog5n5p.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
microsoft.windows[1].xml
AppCache134369487876822720.txt.~tmp
__PSScriptPolicyTest_noyep3py.0h4.ps1
memory/764-76-0x0000024ECC440000-0x0000024ECC462000-memory.dmp
memory/764-74-0x0000024EE4AE0000-0x0000024EE4AF0000-memory.dmp
memory/764-75-0x0000024EE4AE0000-0x0000024EE4AF0000-memory.dmp
memory/3284-221-0x000000000B790000-0x000000000B7E0000-memory.dmp
memory/3284-368-0x00000000090C0000-0x0000000009110000-memory.dmp
memory/3284-42-0x0000000009380000-0x0000000009454000-memory.dmp
memory/3284-26-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-70-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-69-0x00000000076A0000-0x00000000076CE000-memory.dmp
memory/3284-68-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-28-0x0000000008D00000-0x0000000008D50000-memory.dmp
memory/3284-22-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-20-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-14-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-9-0x0000000180000000-0x0000000180050000-memory.dmp
memory/3284-7-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-5-0x0000000008750000-0x000000000879A000-memory.dmp
memory/3284-3-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-4-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-128-0x0000000009230000-0x0000000009280000-memory.dmp
memory/3284-138-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-137-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-146-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-153-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-148-0x0000000009400000-0x0000000009450000-memory.dmp
memory/3284-162-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-171-0x0000000009390000-0x00000000093E0000-memory.dmp
memory/3284-177-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-188-0x0000000009450000-0x00000000094A0000-memory.dmp
memory/3284-186-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-0-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-240-0x000000000C160000-0x000000000C1B0000-memory.dmp
memory/3284-281-0x000000000BF70000-0x000000000BFC0000-memory.dmp
memory/3284-300-0x000000000C430000-0x000000000C480000-memory.dmp
memory/3284-343-0x000000000C330000-0x000000000C380000-memory.dmp
memory/3284-373-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-60-0x0000000002480000-0x0000000002481000-memory.dmp
memory/3284-366-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-397-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-398-0x0000000008700000-0x0000000008736000-memory.dmp
memory/3284-424-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-417-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-420-0x0000000008750000-0x00000000087A0000-memory.dmp
memory/3284-444-0x000000000C5B0000-0x000000000C600000-memory.dmp
memory/3284-462-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-463-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/3284-503-0x000000000B3B0000-0x000000000B400000-memory.dmp
memory/3284-530-0x000000000E320000-0x000000000E370000-memory.dmp
memory/3284-597-0x0000000008CB0000-0x0000000008D00000-memory.dmp
memory/3284-626-0x0000000009140000-0x0000000009190000-memory.dmp
memory/3284-698-0x000000000E530000-0x000000000E580000-memory.dmp
memory/3284-726-0x000000000FB40000-0x000000000FB90000-memory.dmp
memory/3284-805-0x000000000E1A0000-0x000000000E1F0000-memory.dmp
memory/3284-838-0x0000000009320000-0x0000000009370000-memory.dmp
memory/3284-924-0x000000000FCA0000-0x000000000FCF0000-memory.dmp
memory/3284-958-0x0000000010AC0000-0x0000000010B10000-memory.dmp
memory/3284-1047-0x0000000010250000-0x00000000102A0000-memory.dmp
memory/3284-1084-0x0000000010420000-0x0000000010470000-memory.dmp
memory/3284-1178-0x000000000B070000-0x000000000B0C0000-memory.dmp
memory/3284-1223-0x000000000C760000-0x000000000C7B0000-memory.dmp
memory/3284-1320-0x0000000010950000-0x00000000109A0000-memory.dmp
memory/3284-1368-0x00000000109A0000-0x00000000109F0000-memory.dmp
memory/3284-1461-0x000000000DEA0000-0x000000000DEF0000-memory.dmp
memory/3284-1524-0x000000000DEF0000-0x000000000DF40000-memory.dmp
memory/3284-1623-0x000000000B590000-0x000000000B5E0000-memory.dmp
memory/3284-1692-0x0000000011830000-0x0000000011880000-memory.dmp
memory/3284-1830-0x0000000010150000-0x00000000101A0000-memory.dmp
memory/3284-1772-0x0000000010FE0000-0x0000000011030000-memory.dmp
memory/3284-1946-0x00000000104F0000-0x0000000010540000-memory.dmp
memory/3284-1-0x00000000024A0000-0x00000000024CE000-memory.dmp
memory/3284-2-0x00000000026A0000-0x00000000026D6000-memory.dmp