valleyrat_s2 | 3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938

Resubmissions

02/11/2026, 04:57

261102-fld1haez7z7

02/11/2026, 04:31

261102-e5f4jasw3r10

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe
Size 366KB
Sample261102-e5f4jasw3r
SHA256 3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938
MD5 fa9a74cfeb4fcf1e831634bc51dd1eb0
SHA1 2dbe9e46547cf9f2e1d0841798c4fd8ea93f1ae6
SHA512 9346c5d031dfc403ccaec5a3c1f0f02843a1eecc686efe2dfcf22eb779b659856b3649d837eceae2fe69f92d95411ab1f666c901838710a0f62e204e0f3c8e80
SSDEEP 6144:0tH/xNLaAOvIBd7lAAxWS1elIoSNzT+tMXcuq/QIx4UNeMn:0tH5NLaAdDhAAEIFNT+t5PYe4dg
TLSH
T14C84D102B9C189B2D52218335A259F20B67C7C301F668DDBA3D46D5DEE361C09736BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery valleyrat_s2 persistence ransomware

Malware Config

Extracted

Family

valleyrat_s2

156.247.40.170:1218

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 20 IoCs

resource	yara_rule
behavioral2/memory/3456-32-0x00000000010E0000-0x0000000001136000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-34-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-47-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-45-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-43-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-42-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-41-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-40-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-39-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-38-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-37-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-36-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-33-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-44-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-35-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-48-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-50-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-51-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-53-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3456-54-0x0000000000DE0000-0x0000000000E3C000-memory.dmp	family_valleyrat_stage_2_v2

Executes dropped EXE 1 IoCs

pid	Process
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\Z:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\D:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\H:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\L:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\P:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\Q:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\R:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\T:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\W:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\G:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\M:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\S:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\X:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\I:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\N:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\Y:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\B:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\J:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\K:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\O:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
File opened (read-only)	\??\U:	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3456	ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3456	3344	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe	88
PID 3344 wrote to memory of 2308	3344	3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe
"C:\Users\Admin\AppData\Local\Temp\3888e2efc22669bfcccbb34cbfdebedb33914fbdf3765f737625755f2b4e3938.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
  "C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3456
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe

Path C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.exe
Size 108KB
SHA256 2f5a73ddcace0dc55bd5240551003255bf8873e52878d2476d39deafc9b9c2ee
MD5 b5722c02acf5ba01efeceec314136378
SHA1 028ed50b8b3846f6531dd1a0c96bcfe7a602e65a
SHA512 2f672a62f71616e8af5e87aadceda55da7ed6f561e65c19354bb4dc180742ad602fc0b32fd220f18351db307cce6e1d7d7f5fe9d6ccbc360665994bd8f251027
SSDEEP 3072:tjNuE0jFJK6jYokyCSQnL3EUYlAGt+Cf:/JoHBzCSuE
TLSH
T1E2B35B57A7A530F8F5B7467888510A49D772783217B1AFEF03A4468A1F236D18E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.txt

Path C:\Users\Admin\AppData\Local\Temp\ទម្រង់លិខិតអនុញ្ញាតច្បាប់0_.txt
Size 12B
SHA256 0e3c27ec36d0b1e464b40c47b1bac3d289283209ce8c64c783c3f932d1a94aa9
MD5 77c95249036662f0bbf64165c2daa9f4
SHA1 252cb45545fd1751668dea20c4695b592389e83a
SHA512 01b7098360b09e7b875221b98948ecdee0ce4445428abc2664aca043c29c93577190b54ebcc69ae0a0c06ea61485641f7fa6a86b44ce37ec1bf386200aae5a3a
MD5 SHA1 SHA512

Submit Download

memory/3456-16-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/3456-18-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-24-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-23-0x00000000008E0000-0x0000000000961000-memory.dmp

Download

memory/3456-22-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-21-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-20-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-19-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-25-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-28-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-29-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-30-0x0000000000970000-0x000000000099A000-memory.dmp

Download

memory/3456-32-0x00000000010E0000-0x0000000001136000-memory.dmp

Download

memory/3456-34-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-47-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-45-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-43-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-42-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-41-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-40-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-39-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-38-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-37-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-36-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-33-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-44-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-35-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-48-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-50-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-51-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-53-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download

memory/3456-54-0x0000000000DE0000-0x0000000000E3C000-memory.dmp

Download