Analysis
- user interaction
yes - max time kernel
89s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
final.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target final.dll
- Size 183KB
- Sample261102-c4ccvadh95
- SHA256 44a0e506ace77d147961f568d910130f1e024c1939c0636f1fe57743a81c401c
- MD5 0e0fbf00d7807a39115999882955244d
- SHA1 6765d8a29b7941f20a5c83ca4727b41b87abb052
- SHA512 545431c77a675a2a4408f3bac47eb09cd2d2544b21870668a3a0fc65e3cd763a11a554bd3a23c4e2070d36ff02b5f115deacf019680fecf01011959cee02952e
- SSDEEP 3072:6DsqZ/jNozWPf2tOlTTqNr0j9xqnN76WyOYe1xOZ+RBfXupwpFYqdr/a/d:6HNozWH5TTXoN7R5YeKc+bd
- TLSH T16F045A46B3A500B6ED6382788D634A46E77274554370ABCF576083BADF2B7D07A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.76.170.135:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2552 rundll32.exe 3 2552 rundll32.exe 4 2552 rundll32.exe 5 2552 rundll32.exe 6 2552 rundll32.exe 7 2552 rundll32.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2684 powershell.exe 5796 powershell.exe 2788 powershell.exe 5676 powershell.exe 4424 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 2596 jsvtp7sm.exe - Loads dropped DLL 1 IoCs
pid Process 2596 jsvtp7sm.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Process not Found File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\H: Process not Found File opened (read-only) \??\O: Process not Found File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\J: Process not Found File opened (read-only) \??\R: Process not Found File opened (read-only) \??\W: Process not Found File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\B: Process not Found File opened (read-only) \??\V: Process not Found File opened (read-only) \??\X: Process not Found File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\L: Process not Found File opened (read-only) \??\M: Process not Found File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\N: Process not Found File opened (read-only) \??\T: Process not Found File opened (read-only) \??\Y: Process not Found File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\D: Process not Found File opened (read-only) \??\P: Process not Found File opened (read-only) \??\S: Process not Found File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\G: Process not Found File opened (read-only) \??\I: Process not Found File opened (read-only) \??\K: Process not Found File opened (read-only) \??\U: Process not Found File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\Q: Process not Found - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2552 rundll32.exe - Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
pid Process 2596 jsvtp7sm.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4424 powershell.exe Token: SeShutdownPrivilege 4500 Process not Found Token: SeCreatePagefilePrivilege 4500 Process not Found Token: SeShutdownPrivilege 4500 Process not Found Token: SeCreatePagefilePrivilege 4500 Process not Found Token: SeIncreaseQuotaPrivilege 4424 powershell.exe Token: SeSecurityPrivilege 4424 powershell.exe Token: SeTakeOwnershipPrivilege 4424 powershell.exe Token: SeLoadDriverPrivilege 4424 powershell.exe Token: SeSystemProfilePrivilege 4424 powershell.exe Token: SeSystemtimePrivilege 4424 powershell.exe Token: SeProfSingleProcessPrivilege 4424 powershell.exe Token: SeIncBasePriorityPrivilege 4424 powershell.exe Token: SeCreatePagefilePrivilege 4424 powershell.exe Token: SeBackupPrivilege 4424 powershell.exe Token: SeRestorePrivilege 4424 powershell.exe Token: SeShutdownPrivilege 4424 powershell.exe Token: SeDebugPrivilege 4424 powershell.exe Token: SeSystemEnvironmentPrivilege 4424 powershell.exe Token: SeRemoteShutdownPrivilege 4424 powershell.exe Token: SeUndockPrivilege 4424 powershell.exe Token: SeManageVolumePrivilege 4424 powershell.exe Token: 33 4424 powershell.exe Token: 34 4424 powershell.exe Token: 35 4424 powershell.exe Token: 36 4424 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeIncreaseQuotaPrivilege 2684 powershell.exe Token: SeSecurityPrivilege 2684 powershell.exe Token: SeTakeOwnershipPrivilege 2684 powershell.exe Token: SeLoadDriverPrivilege 2684 powershell.exe Token: SeSystemProfilePrivilege 2684 powershell.exe Token: SeSystemtimePrivilege 2684 powershell.exe Token: SeProfSingleProcessPrivilege 2684 powershell.exe Token: SeIncBasePriorityPrivilege 2684 powershell.exe Token: SeCreatePagefilePrivilege 2684 powershell.exe Token: SeBackupPrivilege 2684 powershell.exe Token: SeRestorePrivilege 2684 powershell.exe Token: SeShutdownPrivilege 2684 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeSystemEnvironmentPrivilege 2684 powershell.exe Token: SeRemoteShutdownPrivilege 2684 powershell.exe Token: SeUndockPrivilege 2684 powershell.exe Token: SeManageVolumePrivilege 2684 powershell.exe Token: 33 2684 powershell.exe Token: 34 2684 powershell.exe Token: 35 2684 powershell.exe Token: 36 2684 powershell.exe Token: SeDebugPrivilege 5796 powershell.exe Token: SeIncreaseQuotaPrivilege 5796 powershell.exe Token: SeSecurityPrivilege 5796 powershell.exe Token: SeTakeOwnershipPrivilege 5796 powershell.exe Token: SeLoadDriverPrivilege 5796 powershell.exe Token: SeSystemProfilePrivilege 5796 powershell.exe Token: SeSystemtimePrivilege 5796 powershell.exe Token: SeProfSingleProcessPrivilege 5796 powershell.exe Token: SeIncBasePriorityPrivilege 5796 powershell.exe Token: SeCreatePagefilePrivilege 5796 powershell.exe Token: SeBackupPrivilege 5796 powershell.exe Token: SeRestorePrivilege 5796 powershell.exe Token: SeShutdownPrivilege 5796 powershell.exe Token: SeDebugPrivilege 5796 powershell.exe Token: SeSystemEnvironmentPrivilege 5796 powershell.exe Token: SeRemoteShutdownPrivilege 5796 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2552 rundll32.exe 4500 Process not Found - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2552 wrote to memory of 4424 2552 rundll32.exe 92 PID 2552 wrote to memory of 2684 2552 rundll32.exe 95 PID 2552 wrote to memory of 5796 2552 rundll32.exe 97 PID 2552 wrote to memory of 2788 2552 rundll32.exe 99 PID 2552 wrote to memory of 5676 2552 rundll32.exe 101 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\final.dll,#11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
PID:2788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
PID:5676
-
-
C:\ProgramData\EdgeUpdate\2lil8zdn\jsvtp7sm.exeC:\ProgramData\EdgeUpdate\2lil8zdn\jsvtp7sm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:2596
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\EdgeUpdate\2lil8zdn\config.log
- Size 185KB
- SHA256 f745086049fef5d3912f5c15ad94fa96214e81eee02f4f748a718a03bb46ba71
- MD5 2e2f30638bb0d734bb19806458ccb7ae
- SHA1 65189daa26cd1a6c893145c4907adc0366bc8218
- SHA512 c20db14c20dfbc0f75778a651880e0ad89b886ec725f18941396f31326b9b8b02d3923ae93cfb8c43977e29365cf129e539021fdceb8127338c28fcb7915e346
- SSDEEP 3072:aU5DsqZ/jNozWPf2tOlTTqNr0j9xqnN76WyOYe1xOZ+RBfXupwpFYqdr/a/d:75HNozWH5TTXoN7R5YeKc+bd
- TLSH T1A7045A46B3A500BAED6381788D638A46F77274554370ABCF576083BADF2B7D07A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\EdgeUpdate\2lil8zdn\jsvtp7sm.exe
- Size 367KB
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
- MD5 d455b3b0529d73929fb2f2ecd43b4f75
- SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
- SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
- SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
- TLSH T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
- MD5 81b56f1dad28119d54bf23c83fc570b9
- SHA1 cb9a89a716465611149ce3c700bd60681d434faf
- SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
- TLSH T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c19e175d8d47cc28a9c8aa8d9e51ddffa8af5189fdfe909785b4a4db6dd40c89
- MD5 1b75cf3a0fa4064ed4a9daab57f4b9c9
- SHA1 04384c46264f44bb009a287cf17b6e6ecd1b3acf
- SHA512 f5c8f8f7c195fd029c97a8b61fb01c64eb7898880c66b2cca7953a81a3659048534edf7a1e27c3a46248c1506406480e90eca0dbc286b1b1f349882470d02d63
- TLSH T1D9218B37B3DD8614C89A413A10CDAC1036B6C7DB81DECFAB7B84E659A43F699CF61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 168454fbd10bd6c316787e0630eccd8473426abab36526d9269a91f4bb86727e
- MD5 63a0f9f2a7e2c55eb05bb487e7ce4d25
- SHA1 732a481a3ae95a8a8a9c8965aacfcabf02069428
- SHA512 f1c582b60867619dcdd3d3cc6283a8bce08695d14461445f63c3fe31d28f2afcab5ca4e0b7a659cee7f0439f336d654570548778d5690469daf050aa24e27f82
- TLSH T163214633F3DD8655C899413A10CEAC1036BB87DB409E8E9B6B84D559A42F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_civ5yxfe.2ia.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH