Analysis
- max time kernel
33s - max time network
335s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 05:43
General
- Target Open_to_view.exe
- Size 25KB
- Sample261020-getcaavy9l
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.243.109.132:5252
-
campaign_date
20261019
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe"C:\Users\Admin\AppData\Local\Temp\Open_to_view.exe"1⤵
- Direct Volume Access: Opens a physical disk for reading
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\ProgramData\EdgeUpdate\qr3m6sp0\clgyl55v.exeC:\ProgramData\EdgeUpdate\qr3m6sp0\clgyl55v.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
clgyl55v.exe
config.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vnuus4cz.xpo.ps1
memory/1196-116-0x000001F56B240000-0x000001F56B2F2000-memory.dmp
memory/1196-81-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-70-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-124-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-89-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-115-0x000001F56AED0000-0x000001F56AEEE000-memory.dmp
memory/1196-117-0x000001F56AEF0000-0x000001F56AEFA000-memory.dmp
memory/1196-69-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-72-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-78-0x000001F56AE30000-0x000001F56AE52000-memory.dmp
memory/1196-68-0x00007FFD4C57F000-0x00007FFD4C580000-memory.dmp
memory/1196-71-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-82-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-84-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-85-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-86-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-87-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-88-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-93-0x00007FFD4C3F0000-0x00007FFD4CD94000-memory.dmp
memory/1196-107-0x000001F56AEA0000-0x000001F56AEB0000-memory.dmp
memory/1196-95-0x000001F56AEA0000-0x000001F56AEB0000-memory.dmp
memory/3624-171-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-293-0x0000000009D80000-0x0000000009DD0000-memory.dmp
memory/3624-92-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-44-0x0000000009D00000-0x0000000009DD4000-memory.dmp
memory/3624-26-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-101-0x0000000008420000-0x0000000008470000-memory.dmp
memory/3624-28-0x0000000007030000-0x0000000007080000-memory.dmp
memory/3624-96-0x00000000066E0000-0x000000000670E000-memory.dmp
memory/3624-94-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-21-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-20-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-14-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-9-0x0000000180000000-0x0000000180050000-memory.dmp
memory/3624-7-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-5-0x00000000069E0000-0x0000000006A2A000-memory.dmp
memory/3624-4-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-144-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-145-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-3-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-166-0x000000000A300000-0x000000000A350000-memory.dmp
memory/3624-1-0x00000000015A0000-0x00000000015CE000-memory.dmp
memory/3624-164-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-2-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-184-0x000000000A490000-0x000000000A4E0000-memory.dmp
memory/3624-0-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-223-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-224-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-239-0x000000000A160000-0x000000000A1B0000-memory.dmp
memory/3624-237-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-249-0x000000000A2B0000-0x000000000A300000-memory.dmp
memory/3624-244-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-273-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-276-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-60-0x0000000001580000-0x0000000001581000-memory.dmp
memory/3624-298-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-291-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-307-0x000000000A060000-0x000000000A0B0000-memory.dmp
memory/3624-327-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-328-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-357-0x000000000A370000-0x000000000A3C0000-memory.dmp
memory/3624-382-0x000000000A6F0000-0x000000000A740000-memory.dmp
memory/3624-447-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-449-0x000000000A8F0000-0x000000000A940000-memory.dmp
memory/3624-454-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-474-0x000000000AA80000-0x000000000AAD0000-memory.dmp
memory/3624-493-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-494-0x0000000006C30000-0x0000000006C66000-memory.dmp
memory/3624-540-0x00000000069E0000-0x0000000006A30000-memory.dmp
memory/3624-545-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-538-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-553-0x000000000ED60000-0x000000000EDB0000-memory.dmp
memory/3624-588-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-587-0x0000000004210000-0x0000000004246000-memory.dmp
memory/3624-633-0x000000000EDD0000-0x000000000EE20000-memory.dmp
memory/3624-672-0x000000000EBE0000-0x000000000EC30000-memory.dmp
memory/3624-734-0x000000000EC30000-0x000000000EC80000-memory.dmp
memory/3624-766-0x000000000F9E0000-0x000000000FA30000-memory.dmp
memory/3624-864-0x000000000FB70000-0x000000000FBC0000-memory.dmp
memory/3624-917-0x0000000011EF0000-0x0000000011F40000-memory.dmp
memory/3624-1007-0x000000000FD60000-0x000000000FDB0000-memory.dmp
memory/3624-1042-0x0000000010670000-0x00000000106C0000-memory.dmp
memory/3624-1190-0x000000000FC60000-0x000000000FCB0000-memory.dmp
memory/3624-1241-0x0000000010870000-0x00000000108C0000-memory.dmp
memory/3624-1367-0x000000000FA70000-0x000000000FAC0000-memory.dmp
memory/3624-1382-0x000000000FAC0000-0x000000000FB10000-memory.dmp
memory/3624-1483-0x0000000011FC0000-0x0000000012010000-memory.dmp
memory/3624-1471-0x000000000FB10000-0x000000000FB60000-memory.dmp
memory/3624-1655-0x00000000121C0000-0x0000000012210000-memory.dmp