Resubmissions
29/10/2026, 08:28
261029-kdcjxsxz7j528/10/2026, 09:16
261028-k8eyjaby3q1028/10/2026, 08:47
261028-kp4sjsyw4p1027/10/2026, 08:43
261027-km19msda9510Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 08:43
General
- Target winhttp.dll
- Size 376KB
- Sample261027-km19msda95
- SHA256 3a194dbc100b082ac4208ab5d970e44c8a801f8610e744efedaf4bcd6fcf2025
Score
10/10
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
8.215.33.249:5252
Attributes
-
campaign_date
20261021
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\winhttp.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3324-3-0x00000000025E0000-0x0000000002616000-memory.dmp
memory/3324-4-0x00000000025E0000-0x0000000002616000-memory.dmp
memory/3324-6-0x00000000025E0000-0x0000000002616000-memory.dmp
memory/4796-1-0x000002BD19810000-0x000002BD1983E000-memory.dmp
memory/4796-0-0x000002BD17F40000-0x000002BD17F41000-memory.dmp