Resubmissions
29/10/2026, 08:28
261029-kdcjxsxz7j528/10/2026, 09:16
261028-k8eyjaby3q1028/10/2026, 08:47
261028-kp4sjsyw4p1027/10/2026, 08:43
261027-km19msda9510Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 08:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
10-22 Financial Statement.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
10-22 Financial Statement.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
winhttp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
winhttp.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 10-22 Financial Statement.exe
- Size 25KB
- Sample261027-km19msda95
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
- MD5 e6363b8ec386338ce08f159a739f0e97
- SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
- SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
- SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
- TLSH T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
8.215.33.249:5252
Attributes
-
campaign_date
20261021
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4692 10-22 Financial Statement.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1804 explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe Token: SeShutdownPrivilege 1804 explorer.exe Token: SeCreatePagefilePrivilege 1804 explorer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4692 wrote to memory of 1804 4692 10-22 Financial Statement.exe 81
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\10-22 Financial Statement.exe"C:\Users\Admin\AppData\Local\Temp\10-22 Financial Statement.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4692
-