Analysis
- max time kernel
27s - max time network
559s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 05:43
General
- Target winhttp.dll
- Size 208KB
- Sample261020-getcaavy9l
- SHA256 14e261553c4dba16c53a50b6f1409858f7a897d1c2314e94d222273527452e34
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.243.109.132:5252
-
campaign_date
20261019
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\winhttp.dll,#11⤵
- Direct Volume Access: Opens a physical disk for reading
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\ProgramData\EdgeUpdate\7ih80hkr\x8h5izgo.exeC:\ProgramData\EdgeUpdate\7ih80hkr\x8h5izgo.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
x8h5izgo.exe
DisplaySessionContainers.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_f2mzf4cb.hus.psm1
memory/2304-74-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-82-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-70-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-108-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-102-0x0000018E9FA50000-0x0000018E9FA6E000-memory.dmp
memory/2304-105-0x0000018E9FA40000-0x0000018E9FA4A000-memory.dmp
memory/2304-103-0x00007FF4EA6C0000-0x00007FF4EA6D0000-memory.dmp
memory/2304-104-0x0000018E9FC80000-0x0000018E9FD32000-memory.dmp
memory/2304-68-0x00007FFBD5CEF000-0x00007FFBD5CF0000-memory.dmp
memory/2304-69-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-84-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-71-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-83-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-78-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-77-0x0000018E9F9A0000-0x0000018E9F9C2000-memory.dmp
memory/2304-79-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-80-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/2304-81-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/4440-223-0x000000000A060000-0x000000000A0B0000-memory.dmp
memory/4440-205-0x0000000009D20000-0x0000000009D70000-memory.dmp
memory/4440-89-0x00000000061A0000-0x00000000061F0000-memory.dmp
memory/4440-0-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-97-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-99-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-98-0x0000000003810000-0x000000000383E000-memory.dmp
memory/4440-9-0x0000000180000000-0x0000000180050000-memory.dmp
memory/4440-14-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-58-0x0000000003270000-0x0000000003271000-memory.dmp
memory/4440-42-0x0000000009020000-0x00000000090F4000-memory.dmp
memory/4440-26-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-7-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-28-0x00000000060D0000-0x0000000006120000-memory.dmp
memory/4440-5-0x0000000005B80000-0x0000000005BCA000-memory.dmp
memory/4440-3-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-149-0x0000000007920000-0x0000000007970000-memory.dmp
memory/4440-136-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-21-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-20-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-4-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-154-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-147-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-166-0x00000000090A0000-0x00000000090F0000-memory.dmp
memory/4440-175-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-176-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-202-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-2-0x0000000003230000-0x0000000003266000-memory.dmp
memory/4440-135-0x0000000005E80000-0x0000000005EB6000-memory.dmp
memory/4440-251-0x0000000009D70000-0x0000000009DC0000-memory.dmp
memory/4440-290-0x0000000009BF0000-0x0000000009C40000-memory.dmp
memory/4440-313-0x0000000009C40000-0x0000000009C90000-memory.dmp
memory/4440-372-0x0000000009DC0000-0x0000000009E10000-memory.dmp
memory/4440-383-0x0000000009F20000-0x0000000009F70000-memory.dmp
memory/4440-445-0x000000000C630000-0x000000000C680000-memory.dmp
memory/4440-457-0x000000000DCC0000-0x000000000DD10000-memory.dmp
memory/4440-535-0x000000000DEA0000-0x000000000DEF0000-memory.dmp
memory/4440-546-0x00000000074C0000-0x0000000007510000-memory.dmp
memory/4440-623-0x000000000DF20000-0x000000000DF70000-memory.dmp
memory/4440-671-0x000000000E330000-0x000000000E380000-memory.dmp
memory/4440-745-0x000000000F430000-0x000000000F480000-memory.dmp
memory/4440-771-0x000000000F910000-0x000000000F960000-memory.dmp
memory/4440-846-0x000000000EBF0000-0x000000000EC40000-memory.dmp
memory/4440-924-0x000000000ECC0000-0x000000000ED10000-memory.dmp
memory/4440-968-0x000000000F890000-0x000000000F8E0000-memory.dmp
memory/4440-1099-0x000000000F980000-0x000000000F9D0000-memory.dmp
memory/4440-1089-0x0000000008DC0000-0x0000000008E10000-memory.dmp
memory/4440-1222-0x0000000012660000-0x00000000126B0000-memory.dmp
memory/4440-1215-0x000000000FF10000-0x000000000FF60000-memory.dmp
memory/4440-1486-0x000000000F690000-0x000000000F6E0000-memory.dmp
memory/4440-1480-0x0000000012960000-0x00000000129B0000-memory.dmp
memory/4440-1787-0x00000000135F0000-0x0000000013640000-memory.dmp
memory/4440-1877-0x000000000F760000-0x000000000F7B0000-memory.dmp
memory/4440-1-0x0000000000A40000-0x0000000000A6E000-memory.dmp
memory/4440-2053-0x000000000DE40000-0x000000000DE90000-memory.dmp
memory/4440-2106-0x000000000F7B0000-0x000000000F800000-memory.dmp