Resubmissions
02/11/2026, 02:17
261102-cq4vyadh771030/10/2026, 09:29
261030-lgc6asa17s1030/10/2026, 08:15
261030-j5m93aax2x10Analysis
- max time kernel
103s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 02:17
General
- Target Financial Statistical Reports.exe
- Size 367KB
- Sample261102-cq4vyadh77
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.76.170.135:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Financial Statistical Reports.exe"C:\Users\Admin\AppData\Local\Temp\Financial Statistical Reports.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\EdgeUpdate\2mnj3bdz\in0024wh.exeC:\ProgramData\EdgeUpdate\2mnj3bdz\in0024wh.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
in0024wh.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_qzbmv2y3.k5l.psm1
memory/1388-78-0x000002CC6F6B0000-0x000002CC6F6BA000-memory.dmp
memory/1388-63-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-68-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-86-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-77-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-76-0x000002CC6F8D0000-0x000002CC6F982000-memory.dmp
memory/1388-75-0x000002CC6F690000-0x000002CC6F6AE000-memory.dmp
memory/1388-72-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-70-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-71-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-69-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-67-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-66-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-65-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-64-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-56-0x00007FFD5178F000-0x00007FFD51790000-memory.dmp
memory/1388-57-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-58-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-62-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1388-61-0x000002CC6F660000-0x000002CC6F682000-memory.dmp
memory/1780-119-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-81-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-50-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/1780-37-0x0000000008FC0000-0x0000000009094000-memory.dmp
memory/1780-6-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-29-0x0000000180000000-0x0000000180051000-memory.dmp
memory/1780-28-0x00007FFD65A30000-0x00007FFD65A86000-memory.dmp
memory/1780-23-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-22-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-17-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-18-0x0000000180000000-0x0000000180051000-memory.dmp
memory/1780-10-0x0000000180000000-0x0000000180051000-memory.dmp
memory/1780-8-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-4-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-137-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-5-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-83-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-82-0x00000000036B0000-0x00000000036DF000-memory.dmp
memory/1780-136-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-9-0x0000000004E00000-0x0000000004E4B000-memory.dmp
memory/1780-3-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-2-0x0000000003870000-0x00000000038A6000-memory.dmp
memory/1780-7-0x0000000004E00000-0x0000000004E4B000-memory.dmp
memory/1780-118-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-124-0x0000000008830000-0x0000000008881000-memory.dmp
memory/1780-131-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-122-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/1780-132-0x00000000036E0000-0x0000000003716000-memory.dmp
memory/5432-0-0x000002BB249C0000-0x000002BB249C1000-memory.dmp
memory/5432-1-0x000002BB24A70000-0x000002BB24AB6000-memory.dmp