Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 09:41
Behavioral task
behavioral1
Sample
Setup.exe$$.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target Setup.exe$$.exe
- Size 27.2MB
- Sample261102-lnwk8at19l
- SHA256 fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd
- MD5 af1fb941c33459d2d30efa337da175f7
- SHA1 e9e5dcabaeb94592ec7d409163f79ccfc241f737
- SHA512 5e4ab197e574c89dc938cd225dd2ec8a103c6e2b44c41937f3baec3f5dcd4a540f5db47ae888f11e287c82226c3234d9f44aef643ecd6cfaad3354ea87b43398
- SSDEEP 786432:mLIZBY3hovce05pTeCMpC7G5FYQuiVR1xhEl:nZGGce0LN2CGYQz+l
- TLSH T18857333BF265A43FD4664B7289B7A250883B7665B51E8D6F43F0091DCF2A4B01F3B249
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
C2
-
192.168.1.200:9999
-
27.124.4.34:62841
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 4 IoCs
resource yara_rule behavioral1/memory/3256-73-0x00000000033D0000-0x000000000341D000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-75-0x00000000033D0000-0x000000000341D000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-76-0x00000000033D0000-0x000000000341D000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3256-77-0x00000000033D0000-0x000000000341D000-memory.dmp family_valleyrat_stage_2_v2 - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2504 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 3092 Setup.exe$$.tmp - Loads dropped DLL 1 IoCs
pid Process 3256 Process not Found - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Process not Found File opened (read-only) \??\N: Process not Found File opened (read-only) \??\P: Process not Found File opened (read-only) \??\B: Process not Found File opened (read-only) \??\J: Process not Found File opened (read-only) \??\M: Process not Found File opened (read-only) \??\R: Process not Found File opened (read-only) \??\K: Process not Found File opened (read-only) \??\L: Process not Found File opened (read-only) \??\Q: Process not Found File opened (read-only) \??\S: Process not Found File opened (read-only) \??\T: Process not Found File opened (read-only) \??\U: Process not Found File opened (read-only) \??\V: Process not Found File opened (read-only) \??\X: Process not Found File opened (read-only) \??\H: Process not Found File opened (read-only) \??\I: Process not Found File opened (read-only) \??\O: Process not Found File opened (read-only) \??\W: Process not Found File opened (read-only) \??\Y: Process not Found File opened (read-only) \??\Z: Process not Found File opened (read-only) \??\E: Process not Found - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\C Setup.exe$$.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe$$.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe$$.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/4916-1-0x0000000000400000-0x00000000004CC000-memory.dmp innosetup behavioral1/memory/4916-81-0x0000000000400000-0x00000000004CC000-memory.dmp innosetup behavioral1/memory/4916-86-0x0000000000400000-0x00000000004CC000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3092 Setup.exe$$.tmp 3092 Setup.exe$$.tmp 2504 powershell.exe 2504 powershell.exe 2504 powershell.exe 2504 powershell.exe 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found 3256 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3256 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2504 powershell.exe Token: SeIncreaseQuotaPrivilege 2504 powershell.exe Token: SeSecurityPrivilege 2504 powershell.exe Token: SeTakeOwnershipPrivilege 2504 powershell.exe Token: SeLoadDriverPrivilege 2504 powershell.exe Token: SeSystemProfilePrivilege 2504 powershell.exe Token: SeSystemtimePrivilege 2504 powershell.exe Token: SeProfSingleProcessPrivilege 2504 powershell.exe Token: SeIncBasePriorityPrivilege 2504 powershell.exe Token: SeCreatePagefilePrivilege 2504 powershell.exe Token: SeBackupPrivilege 2504 powershell.exe Token: SeRestorePrivilege 2504 powershell.exe Token: SeShutdownPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeSystemEnvironmentPrivilege 2504 powershell.exe Token: SeRemoteShutdownPrivilege 2504 powershell.exe Token: SeUndockPrivilege 2504 powershell.exe Token: SeManageVolumePrivilege 2504 powershell.exe Token: 33 2504 powershell.exe Token: 34 2504 powershell.exe Token: 35 2504 powershell.exe Token: 36 2504 powershell.exe Token: SeIncreaseQuotaPrivilege 2504 powershell.exe Token: SeSecurityPrivilege 2504 powershell.exe Token: SeTakeOwnershipPrivilege 2504 powershell.exe Token: SeLoadDriverPrivilege 2504 powershell.exe Token: SeSystemProfilePrivilege 2504 powershell.exe Token: SeSystemtimePrivilege 2504 powershell.exe Token: SeProfSingleProcessPrivilege 2504 powershell.exe Token: SeIncBasePriorityPrivilege 2504 powershell.exe Token: SeCreatePagefilePrivilege 2504 powershell.exe Token: SeBackupPrivilege 2504 powershell.exe Token: SeRestorePrivilege 2504 powershell.exe Token: SeShutdownPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeSystemEnvironmentPrivilege 2504 powershell.exe Token: SeRemoteShutdownPrivilege 2504 powershell.exe Token: SeUndockPrivilege 2504 powershell.exe Token: SeManageVolumePrivilege 2504 powershell.exe Token: 33 2504 powershell.exe Token: 34 2504 powershell.exe Token: 35 2504 powershell.exe Token: 36 2504 powershell.exe Token: SeIncreaseQuotaPrivilege 2504 powershell.exe Token: SeSecurityPrivilege 2504 powershell.exe Token: SeTakeOwnershipPrivilege 2504 powershell.exe Token: SeLoadDriverPrivilege 2504 powershell.exe Token: SeSystemProfilePrivilege 2504 powershell.exe Token: SeSystemtimePrivilege 2504 powershell.exe Token: SeProfSingleProcessPrivilege 2504 powershell.exe Token: SeIncBasePriorityPrivilege 2504 powershell.exe Token: SeCreatePagefilePrivilege 2504 powershell.exe Token: SeBackupPrivilege 2504 powershell.exe Token: SeRestorePrivilege 2504 powershell.exe Token: SeShutdownPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeSystemEnvironmentPrivilege 2504 powershell.exe Token: SeRemoteShutdownPrivilege 2504 powershell.exe Token: SeUndockPrivilege 2504 powershell.exe Token: SeManageVolumePrivilege 2504 powershell.exe Token: 33 2504 powershell.exe Token: 34 2504 powershell.exe Token: 35 2504 powershell.exe Token: 36 2504 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3092 Setup.exe$$.tmp - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4916 wrote to memory of 3092 4916 Setup.exe$$.exe 86 PID 3092 wrote to memory of 2504 3092 Setup.exe$$.tmp 88 PID 2504 wrote to memory of 468 2504 powershell.exe 93 PID 468 wrote to memory of 1940 468 csc.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe$$.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe$$.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\is-BVQ7E.tmp\Setup.exe$$.tmp"C:\Users\Admin\AppData\Local\Temp\is-BVQ7E.tmp\Setup.exe$$.tmp" /SL5="$A01DE,27675946,779264,C:\Users\Admin\AppData\Local\Temp\Setup.exe$$.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\is-UR6VT.tmp\__exo.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ptal1kpc\ptal1kpc.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1F8.tmp" "c:\Users\Admin\AppData\Local\Temp\ptal1kpc\CSCFB1A489E11442089846B1A245ADE3C6.TMP"5⤵PID:1940
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RESA1F8.tmp
- Size 1KB
- SHA256 ec77bd39a3ce2f1fcd0833b568d58a7c1983cccf97128caa757a34c481c27107
- MD5 6c517dccef9c57fab39fd2780e2c4f0e
- SHA1 1850b456debd307bc25a12caa8e4999e28b727b5
- SHA512 ac5eba14011e73137a0dd34c49cbf290653e2eaca8215d2e8fcaf122eefec4750e470666c98bb7b38e643f5cc11eaac5fa353a8d8a390a8906aba2bace3e2a97
- TLSH T11C21AB0593EC471AF077173169FA076F9279FD64EFA2979B8940022D1C41644DEA0B76
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fhe4fna4.usm.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-BVQ7E.tmp\Setup.exe$$.tmp
- Size 2.9MB
- SHA256 9956cdc11071e9c373719f49a8c97941405a785a32a7c415bebfeab4c959cb5e
- MD5 bfbfd4015cb2a98ad2eb454a6c7777b0
- SHA1 67c6490645edf6eba38cfc7e66a5b21ae9bb8bb4
- SHA512 9d1995c32ed8231c2e596e7adb38f23a661c53b805fd7000107a406e380675120b7a2b75bdf2d3bb9b7396c8a525f36469cec135db32af45321b7e91f5b2393b
- SSDEEP 49152:fLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvu:dwSi0b67zeCzt0+yO3kS
- TLSH T197D54A27F7887D3ED46B0B364A37C690983BB7627A128D575BF0090C8F355942E3EA46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-UR6VT.tmp\__exo.ps1
- Size 11KB
- SHA256 08d8f8836e31a50c2bd071aec650209a83d0a24c6f55b31f9d119b4246a90588
- MD5 86979bed4b221df10717a6051b16d89e
- SHA1 04e83a0d19acb4c36370ba22b1b870ca58a2ba5b
- SHA512 9fb6acc13c59d67eb54253e302c518b04b53508e573c403b5f0b8c35c7c4edb9be761eff30bfa4e40f44d017f44b1856f2c9a6d792910189adfd5c422b8a4afe
- SSDEEP 192:6NzhAVM52NqzWlHQyKk0gFYyqvMquuG3cZatHDRMZXk5ScpG1tnvNjP50jWnf05x:6NR2NqzfMmEcZatHDw05buZlD50jWnfw
- TLSH T15142A528A588720A6972032F8981D145FDAB027346BB1551FA9CD192AFF734E8353D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ptal1kpc\ptal1kpc.dll
- Size 4KB
- SHA256 060e828344cb463913ed2ea7d78162c0266f64b66eedb859c293d6ef6983a3fe
- MD5 76e019afc5c2efb96805718f7e1fcab5
- SHA1 e6dcc6e3180926915919942676c223bbb7dcef78
- SHA512 506eedaf69ee05c0ae5bb86ce5ccd78fa382aa8e6af07570ae9ae34091d7ba827836b8021344c84a150427c2dbebad9d4139cf670219a6e28b0e0ebc85195993
- TLSH T1D3812002D7D84AE7E0B647306DF70B227BF0F4904B338B1F4998422A6CA27501E62BF1
- MD5 SHA1 SHA512 TLSH
- Path C:\path\to\1d.bin
- Size 2KB
- SHA256 0da20cc5cfed0730558721c1fc53f7c3fa91c3326f8ab01af54097ea7e9fea2c
- MD5 5e4a01b779073c957e9e8384901d26df
- SHA1 37de1bee5941d37db1ff5c1a0c93dc8ee49a40d7
- SHA512 d5832247a9d9a6aa2a3efc023edb9a8f489a881ac2dd5345297d6d46f9c12a67df66c4c4660b7cccdfea78d458970eb988a5823838e9f2013f030aebd6cbfbee
- TLSH T10C5153F4614796371DB69ED3ED437E48F2429664EE2393A4083F320B6100EDB26C1EC6
- MD5 SHA1 SHA512 TLSH
- Path C:\path\to\a\1.exe
- Size 12.7MB
- SHA256 0957099cb64fbc050137bfa452e581aa1138d8b8b40740907d5746e75df8fdd1
- MD5 1bc86a457dadcdec5cc46dae8f37dd8f
- SHA1 1e3f9ab6506ec99e105dfeb68688b021c59a71b8
- SHA512 86b6a42a8a89fd396bab8a19bd7c3c3087453174c6d853275a138a7f8a2156530ce7e9325871659b0ae01532f5595be08d204a8bdcae11ccdf9d00b3be0bd486
- SSDEEP 393216:k2qIqzyr20EwEKvJld+FJyEmaiW1mW2vzWe+YUzlESNCvW0CMJoATMnRF1O9/iOW:k7IqCdEnh1Svz2hb0Ctvt
- TLSH T19ED69E02B6604365F4A73232B43D673D49223E625B3485CBEBB47C845FB4AD2253AB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\path\to\deyi.dll
- Size 106KB
- SHA256 a813e324741bff7fe7ec9b7a8b71fa7b95c8dddb936765a27ee812c04d1c186e
- MD5 3a682f9094c4a6c173b346db3a743aac
- SHA1 84d69bbdc0bc7988abd100ce72395de6f755d400
- SHA512 9bf5a4377e6ebc87f8dcf74dc21929af246896096e14c75507486e62bc34c1a8fd751d6c87b86e5b321adbd4ea6dcf77aab407afc281dbec8bc1bb2ecc2aaa05
- SSDEEP 3072:y52AL/kxeY3T+qFOQuC6c4paZaZ8rVXisbi6ia3:yT4WqFOQRy2C
- TLSH T1A5B33A5772FA00BBE1B78639C4630A45D7B2B8114760AFEF47A446991F237E08E3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\ptal1kpc\CSCFB1A489E11442089846B1A245ADE3C6.TMP
- Size 652B
- SHA256 2e8e42e229f0f22b49dc41ffd74773ce0958a017b97b888ab32427cb13a5a109
- MD5 c0e51c71b514b51a82b36325d89591b6
- SHA1 dae77914a2b527d9d46269548f966478a708db14
- SHA512 3b6db7387f4bcf29757043f1e61ab5d4ac46c1711531972a0dffd96a3878d205d9b88cdb6e223aa7f6e340647e787757757c8af83e566624352bb303f26dad91
- TLSH T1F2F03A49B3F8020AF4F34B31BDF643A395ADBC64DE32A3ED2440031D2864A109962FB6
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\ptal1kpc\ptal1kpc.0.cs
- Size 1KB
- SHA256 29eac21a918fb4563613cab9e568b0f702b11619524c8671069cc48c1f3eea0f
- MD5 e5d82c59f69cdd406de66709d948f773
- SHA1 40f8135eda72d55b93220e2001b254db60d2f27c
- SHA512 1c1fd3bcf72829060c857e0b6a5015a4d763095d8a540ec32516aeaf8c57f14df239065bbccd89988af929fc9d1e27fb94ed10329b9be46c2e8155ebcabfd127
- TLSH T1F3213CA86356EB615872442D9C85D0EEFB03007316BE0E05B6FC67234F6B119E77961D
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\ptal1kpc\ptal1kpc.cmdline
- Size 369B
- SHA256 a230337c2d4ac452c8e3b533a8fcb385acdebd10d1ec1af845bc3ec004b43708
- MD5 115624fb1ac6e92fdcf2c93c927e5beb
- SHA1 d2b5ac557882aec0a66a608fbfba470fedfc9e8c
- SHA512 0d027b2000b41cdee4a8f6f26f10237ca920e336fac23491f5147530bad3126b5922a830aa3f72895ebc99b56872eb7117993d6d4ad9f1be4f6e201dd610c647
- TLSH T135E0C02A4746CB7D52DD20072569E4ACC27207432AC2BF84D2D0C40FD4270102BD2791
- MD5 SHA1 SHA512 TLSH