Resubmissions
02/11/2026, 02:17
261102-cq4vyadh771030/10/2026, 09:29
261030-lgc6asa17s1030/10/2026, 08:15
261030-j5m93aax2x10Analysis
- user interaction
yes - max time kernel
95s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 02:17
General
- Target VSPMsg.dll
- Size 9KB
- Sample261102-cq4vyadh77
- SHA256 20fed915cd893469f7b5d74b0f9d1e845b62bfbb4fdf93a8434269e87a193f10
Malware Config
Extracted
-
valleyrat_s2
-
1.0
-
47.76.170.135:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VSPMsg.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\EdgeUpdate\02flcw76\pyxa5gqz.exeC:\ProgramData\EdgeUpdate\02flcw76\pyxa5gqz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"1⤵
- Command and Scripting Interpreter: PowerShell
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.log
pyxa5gqz.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lmdgrknb.y1n.psm1
memory/404-96-0x000001E5E6120000-0x000001E5E6210000-memory.dmp
memory/404-69-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-67-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-97-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-72-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-91-0x000001E5E6120000-0x000001E5E6210000-memory.dmp
memory/404-86-0x000001E5E5B70000-0x000001E5E5B7A000-memory.dmp
memory/404-73-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-82-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-78-0x000001E5E5C00000-0x000001E5E5CB2000-memory.dmp
memory/404-77-0x000001E5E5B80000-0x000001E5E5B9E000-memory.dmp
memory/404-61-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-70-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-68-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-55-0x00007FFD4323F000-0x00007FFD43240000-memory.dmp
memory/404-56-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-60-0x000001E5CD560000-0x000001E5CD582000-memory.dmp
memory/404-59-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-74-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-62-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-63-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-64-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-65-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/404-66-0x00007FFD430B0000-0x00007FFD43A54000-memory.dmp
memory/1264-107-0x0000022B58890000-0x0000022B58980000-memory.dmp
memory/1952-0-0x0000023278B20000-0x0000023278B21000-memory.dmp
memory/1952-1-0x0000023278B40000-0x0000023278B86000-memory.dmp
memory/3504-114-0x000001AE74FE0000-0x000001AE750D0000-memory.dmp
memory/3952-95-0x000002944D840000-0x000002944D930000-memory.dmp
memory/4624-84-0x0000000004430000-0x000000000445F000-memory.dmp
memory/4624-3-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-29-0x0000000180000000-0x0000000180051000-memory.dmp
memory/4624-24-0x00007FFD586E0000-0x00007FFD58736000-memory.dmp
memory/4624-81-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-5-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-83-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-23-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-6-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-22-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-10-0x0000000180000000-0x0000000180051000-memory.dmp
memory/4624-18-0x0000000180000000-0x0000000180051000-memory.dmp
memory/4624-4-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-8-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-31-0x0000000009B50000-0x0000000009C24000-memory.dmp
memory/4624-7-0x00000000044B0000-0x00000000044FB000-memory.dmp
memory/4624-17-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-2-0x0000000003D20000-0x0000000003D56000-memory.dmp
memory/4624-47-0x0000000003CC0000-0x0000000003CC1000-memory.dmp
memory/4624-9-0x00000000044B0000-0x00000000044FB000-memory.dmp
memory/4624-141-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-124-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-125-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-126-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-128-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-137-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/4624-130-0x0000000009650000-0x00000000096A1000-memory.dmp
memory/4624-142-0x0000000006CD0000-0x0000000006D06000-memory.dmp
memory/5060-121-0x00000183CF0A0000-0x00000183CF190000-memory.dmp