Resubmissions
06/11/2026, 08:56
261106-kwc86swt2p1002/11/2026, 02:17
261102-cq4vyadh771030/10/2026, 09:29
261030-lgc6asa17s1030/10/2026, 08:15
261030-j5m93aax2x10Analysis
- user interaction
yes - max time kernel
100s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
02/11/2026, 02:17
General
- Target Financial Statistical Reports.exe
- Size 367KB
- Sample261102-cq4vyadh77
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.76.170.135:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Financial Statistical Reports.exe"C:\Users\Admin\AppData\Local\Temp\Financial Statistical Reports.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\EdgeUpdate\3ou0h5w6\760bezs9.exeC:\ProgramData\EdgeUpdate\3ou0h5w6\760bezs9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
760bezs9.exe
config.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hmt5k1dp.cxn.ps1
memory/1252-1-0x0000023809140000-0x0000023809186000-memory.dmp
memory/1252-0-0x0000023808F60000-0x0000023808F61000-memory.dmp
memory/3164-7-0x00000000072D0000-0x000000000731B000-memory.dmp
memory/3164-9-0x00000000072D0000-0x000000000731B000-memory.dmp
memory/3164-10-0x0000000180000000-0x0000000180051000-memory.dmp
memory/3164-24-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3164-28-0x00007FFC1A250000-0x00007FFC1A2A6000-memory.dmp
memory/3164-29-0x0000000180000000-0x0000000180051000-memory.dmp
memory/3164-32-0x00000000077F0000-0x00000000078C4000-memory.dmp
memory/3164-47-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/3164-17-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3164-8-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3164-55-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-57-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-56-0x0000000004100000-0x000000000412F000-memory.dmp
memory/3164-18-0x0000000180000000-0x0000000180051000-memory.dmp
memory/3164-169-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-6-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3164-165-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-158-0x0000000007950000-0x00000000079A1000-memory.dmp
memory/3164-156-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-152-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-153-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-5-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3164-134-0x0000000004660000-0x0000000004696000-memory.dmp
memory/3164-4-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3164-2-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3164-3-0x0000000004620000-0x0000000004656000-memory.dmp
memory/4376-61-0x00000233F2020000-0x00000233F2030000-memory.dmp
memory/4376-88-0x00000233F4D00000-0x00000233F4D0A000-memory.dmp
memory/4376-89-0x00000233F2020000-0x00000233F2030000-memory.dmp
memory/4376-87-0x00000233F4CF0000-0x00000233F4CF6000-memory.dmp
memory/4376-86-0x00000233F4CC0000-0x00000233F4CC8000-memory.dmp
memory/4376-85-0x00000233F4D10000-0x00000233F4D2A000-memory.dmp
memory/4376-84-0x00000233F4CB0000-0x00000233F4CBA000-memory.dmp
memory/4376-83-0x00000233F4CD0000-0x00000233F4CEC000-memory.dmp
memory/4376-82-0x00000233F4CA0000-0x00000233F4CAA000-memory.dmp
memory/4376-81-0x00000233F4BE0000-0x00000233F4C93000-memory.dmp
memory/4376-80-0x00000233F4BC0000-0x00000233F4BDC000-memory.dmp
memory/4376-73-0x00007FF47D110000-0x00007FF47D120000-memory.dmp
memory/4376-72-0x00000233F2020000-0x00000233F2030000-memory.dmp
memory/4376-67-0x00000233F4B20000-0x00000233F4B42000-memory.dmp
memory/4376-62-0x00000233F2020000-0x00000233F2030000-memory.dmp