Resubmissions
02/11/2026, 02:17
261102-cq4vyadh771030/10/2026, 09:29
261030-lgc6asa17s1030/10/2026, 08:15
261030-j5m93aax2x10Analysis
- max time kernel
109s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/11/2026, 02:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Financial Statistical Reports.exe
Resource
win11-20260911-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Financial Statistical Reports.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
VSPMsg.dll
Resource
win11-20260911-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
VSPMsg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target VSPMsg.dll
- Size 9KB
- Sample261102-cq4vyadh77
- SHA256 20fed915cd893469f7b5d74b0f9d1e845b62bfbb4fdf93a8434269e87a193f10
- MD5 c086f13c6381d7016a7f51d383eaf70b
- SHA1 1831e420e6d64c669cd484fdf5efd04b4bcd74a8
- SHA512 3715f05cec8cacfdb36ad2afbd939e7ca195b090c7dd24568e9d87bca020ee42973171c13a6917aaad112f723ce455987833918618cb67d1b2b9afd1eb2dd878
- SSDEEP 192:5LjzBNDets1OmDZk8Vc+eqyf7H2M/wWZJcYXHrlnT+Qgeol:pvyq1Vdk8eqc6M/wW0yrRCQ2l
- TLSH T18512FA02F7E031FCD87AC27407976123E6B1BC499932E71FAB8257623870651EA39769
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
47.76.170.135:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5788 powershell.exe 5776 powershell.exe 1276 powershell.exe 568 powershell.exe 1732 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5316 janxatnb.exe - Loads dropped DLL 1 IoCs
pid Process 5316 janxatnb.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Process not Found File opened (read-only) \??\J: Process not Found File opened (read-only) \??\L: Process not Found File opened (read-only) \??\Q: Process not Found File opened (read-only) \??\S: Process not Found File opened (read-only) \??\T: Process not Found File opened (read-only) \??\V: Process not Found File opened (read-only) \??\Y: Process not Found File opened (read-only) \??\H: Process not Found File opened (read-only) \??\M: Process not Found File opened (read-only) \??\O: Process not Found File opened (read-only) \??\P: Process not Found File opened (read-only) \??\Z: Process not Found File opened (read-only) \??\B: Process not Found File opened (read-only) \??\G: Process not Found File opened (read-only) \??\K: Process not Found File opened (read-only) \??\N: Process not Found File opened (read-only) \??\W: Process not Found File opened (read-only) \??\I: Process not Found File opened (read-only) \??\R: Process not Found File opened (read-only) \??\U: Process not Found File opened (read-only) \??\X: Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4924 rundll32.exe 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3212 Process not Found - Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
pid Process 5316 janxatnb.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeDebugPrivilege 1276 powershell.exe Token: SeDebugPrivilege 568 powershell.exe Token: SeDebugPrivilege 1732 powershell.exe Token: SeDebugPrivilege 5788 powershell.exe Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeDebugPrivilege 5776 powershell.exe Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found Token: SeCreatePagefilePrivilege 3212 Process not Found Token: SeShutdownPrivilege 3212 Process not Found - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3212 Process not Found 3212 Process not Found 3212 Process not Found - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found 3212 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3212 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3212 wrote to memory of 1908 3212 Process not Found PID 3212 wrote to memory of 1276 3212 Process not Found 82 PID 3212 wrote to memory of 568 3212 Process not Found 84 PID 3212 wrote to memory of 1732 3212 Process not Found 86 PID 3212 wrote to memory of 5788 3212 Process not Found 88 PID 3212 wrote to memory of 5776 3212 Process not Found 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VSPMsg.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924
-
C:\ProgramData\EdgeUpdate\9nig1tag\janxatnb.exeC:\ProgramData\EdgeUpdate\9nig1tag\janxatnb.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:5316
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:568
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5788
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\EdgeUpdate\9nig1tag\config.log
- Size 185KB
- SHA256 f745086049fef5d3912f5c15ad94fa96214e81eee02f4f748a718a03bb46ba71
- MD5 2e2f30638bb0d734bb19806458ccb7ae
- SHA1 65189daa26cd1a6c893145c4907adc0366bc8218
- SHA512 c20db14c20dfbc0f75778a651880e0ad89b886ec725f18941396f31326b9b8b02d3923ae93cfb8c43977e29365cf129e539021fdceb8127338c28fcb7915e346
- SSDEEP 3072:aU5DsqZ/jNozWPf2tOlTTqNr0j9xqnN76WyOYe1xOZ+RBfXupwpFYqdr/a/d:75HNozWH5TTXoN7R5YeKc+bd
- TLSH T1A7045A46B3A500BAED6381788D638A46F77274554370ABCF576083BADF2B7D07A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\EdgeUpdate\9nig1tag\janxatnb.exe
- Size 367KB
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
- MD5 d455b3b0529d73929fb2f2ecd43b4f75
- SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
- SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
- SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
- TLSH T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 4KB
- SHA256 dd16566ab212783e890f0f99ec0b0c501fe85b02aa0ad98f5f9d91ff9080af9d
- MD5 e658fc871c669b740efbcf9672996959
- SHA1 e465bea74f7a594b5f04633332f03e7bdfb71f76
- SHA512 d1d7a7fec050718614f9fe88b7f9be07ca2f5280f7605f1ae456ab61f58a69090511ba38cbeb66064ca3c23104d8dcef1732672238b5ac29634a8c50025a39b4
- SSDEEP 96:iq4uYqGEo9xx+incqKXqntzYfqCYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXqntzYfqRWq2Iz+wx
- TLSH T1E191EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f2aaec18b74edfffd64ff42ac090a56ea84259c03af23398646e1f5176beba1d
- MD5 6037a2fca86631c99b320cd4efade80d
- SHA1 5b1eca7f09daeee77e8bcd90edab39110b352d3c
- SHA512 72ba9c0500d0e1dac43473f77e6ee7d5f274bf2d62a630e94b64fa0db6afb0089f82c899402b6b8caf572d8a347e235f8d2867c4a0932b2f669378f136ac5a2d
- TLSH T170218933B79CC235C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 106842d701d870d9c26603db1485d0545d9e1637d907dba4cbfc5a3f53b1ea71
- MD5 c8bf3de608b2222315f47b4d4eaec94d
- SHA1 e0ac322cf7d9344a8d2c06e77e5aa5ff72d9be95
- SHA512 43879ad973c5fd6882a81fa0f917b7b224f022ebe37f1c97c6564dcf56ac1eb748606149c18e6fce42322c7a246a62fdb36c1134efb29f81a3594d0946d05b16
- TLSH T164218933B79CC134C8D9117A208DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 3a31ff8d06cfcc95f7c8a5777e480a7d6088f629b53549c9a7726e01af0180b3
- MD5 c1708ce442a47b10c1f37a3120d612f6
- SHA1 579c3522120bf7006d2a8b43e93d83021dfa0f04
- SHA512 06ed49e1fb8adf8f370d969bdc4be163f73f1b0f475bb50b97b45d99466bb3ba5ca0d64b1965c183ee7086b4043ce9a07c9ce76d519eae17530a4cd0c6f22d79
- TLSH T176218933B79CC234C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DF645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 8a9e66ad74e2f2e85a14886990da57e2eedc535010a7c3dd1459f99f7ae87436
- MD5 391d9636c35ceb559dccacc31c7601d6
- SHA1 08340ed62cb3140947e4fe8c2a10a3ec5e5a7db0
- SHA512 7950a5af95e1f1eb5a2bd011b13d702540d9c374e788a6da8cff02f87b08e5d514b2a27cd6e22b8a90e6b0478403a850725d27afd1f8065be9a496b6d63eaa50
- TLSH T112218933B79CC135C8D9117A108CAD01B2B5C3C7449ECE9B7B84C508A57F999DB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vsinjto.g0h.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH