ValleyRAT

Software Update Abuse Exploitation of legitimate update mechanisms: Compromise of update channels in popular local Chinese software Injection into software distribution networks Abuse of trusted software vendors’ infrastructure

Deployed through targeted phishing operations: Malicious document attachments (.doc, .xls, .pdf) Compressed archives (.zip, .rar) containing disguised executables

T1566.002 | Initial Access | Phishing: Spearphishing Link | 1 | Phishing via email containing tax invoices directing victims to typosquatting domains.

T1566.003 | Initial Access | Phishing: Spearphishing via Service | 2 | Phishing via WhatsApp messages urging Coretax account activation (with .ZIP attachments).

Task Scheduler Integration : Uses COM API for automatic startup

Defender exclusion commands launched through ShellExecuteA and powershell.exe

T1059.003 | Execution | Command and Scripting Interpreter: Windows Command Shell | 1 | Usage of LOLBins (cmd.exe, conhost.exe) during the dropping/installation process.

The malware campaign embedded malicious code in VBScripts, which were distributed through WhatsApp DMs. The VBScript then dropped the legitimate Remote Monitoring and Management (RMM) tool ManageEngine Endpoint Central.

T1106 | Execution | Native API | 2 | Execution of GetProcAddress and LoadLibrary APIs by the EXE to load DLL functions.

Fake Software Installers ValleyRAT commonly disguises itself within: Fake productivity tools (e.g., “AI表格生成工具” — AI-based spreadsheet generator) Cracked or unofficial software downloads

Task Scheduler Integration : Uses COM API for automatic startup

Static review of rundll32.dat!Edge shows Sauron service behavior: Uses HKCU\SOFTWARE\Sauron

Static review of rundll32.dat!Edge shows Sauron service behavior: Uses HKCU\SOFTWARE\Sauron Copies itself to C:\Windows\svchost.exe when the Sauron key is absent Creates and starts service Sauron

Task Scheduler Integration : Uses COM API for automatic startup

Memory Injection : WriteProcessMemory and CreateRemoteThread for payload delivery

Thread Context Manipulation : Uses SetThreadContext for process hijacking

Static review of rundll32.dat!Edge shows Sauron service behavior: Uses HKCU\SOFTWARE\Sauron Copies itself to C:\Windows\svchost.exe when the Sauron key is absent Creates and starts service Sauron

The heap payload brings the real loader behavior: PEB/export walking for dynamic API resolution

ainstaller-86533005.exe is wearing a Panasonic jacket, and the fit is almost too good. Inspect the file metadata and everything points at PPcNotif.Provider.RequiredApp.exe, Panasonic PC Notification, version 1.10510.0.0.

T1036.004 | Defense Evasion | Masquerading: Masquerade Task or Service | 2 | Renaming executable files (.EXE) using the Indonesian language with taxation contexts.

T1036.005 | Defense Evasion | Masquerading: Match Legitimate Name or Location | 1 | Executing a rogue svchost.exe process outside of its legitimate C:\Windows\System32 directory.

Memory Injection : WriteProcessMemory and CreateRemoteThread for payload delivery

Thread Context Manipulation : Uses SetThreadContext for process hijacking

Triage process telemetry during this phase recorded: cmd.exe /c vssadmin delete shadows /all /quiet

The staged buffer goes through two decoder layers. The second decoder starts with key 0x38, walks 0xce0d bytes, XORs each byte, and feeds the decoded byte back into the key. The fully decoded stage then copies 0xae05 bytes from offset 0x2d and XOR-decodes them with: 4@e!c!bSL2AeimnwyD4x.

thumbs.db decodes to rundll32.dat, whose Edge export implements Sauron behavior.

Timing and environment checks through QueryPerformanceCounter, Sleep, rdtsc, VirtualAllocExNuma, mutex probes, process checks, heap pressure, and COM/object probes

Sandbox Detection : Heuristic analysis to detect analysis environments ... custom SEH handler ... known evasion technique in advanced malware

On execution, the binary allocates a new RWX buffer, copies an encoded stage from its own image, decodes it twice, peels a heap payload with a 19-byte XOR key, and jumps into the loader.

Static review of rundll32.dat!Edge shows Sauron service behavior: Uses HKCU\SOFTWARE\Sauron

T1222.001 | Defense Evasion | Windows File and Directory Permissions Modification | 1 | Modifying file permissions utilizing cmd.exe to ensure seamless malware installation.

Windows Hook Integration : SetWindowsHookEx for keystroke monitoring and control

Registry Analysis : Policy settings, installed software detection

Process Enumeration : Running processes via snapshot APIs

Operating System Information : Version, locale, architecture, environment variables

File System Scanning : Hidden drives, removable media, network shares

Timing and environment checks through QueryPerformanceCounter, Sleep, rdtsc, VirtualAllocExNuma, mutex probes, process checks, heap pressure, and COM/object probes

Sandbox Detection : Heuristic analysis to detect analysis environments ... custom SEH handler ... known evasion technique in advanced malware

Geolocation Data : Collection through locale APIs

Huorong documented the same s.jpg pattern: shellcode, compressed DLL, RPC Task Scheduler logic, and NdrClientCall3... Cover Task Scheduler RPC alongside command-line schtasks.exe: 86D35949-83C9-4044-B424-DB363231FD0C ncacn_np \pipe\atsvc NdrClientCall3

Windows Hook Integration : SetWindowsHookEx for keystroke monitoring and control

Traffic Mimicry : HTTP tunneling and benign traffic patterns

When I examined the ValleyRAT C2 traffic from the Triage sandbox execution I noticed that CapLoader as well as FlowCarp identified it as Gh0stKCP, which is a UDP-based protocol that ValleyRAT sometimes uses to transport its C2 traffic.

Modular Commands : File upload/download, shell execution, payload injection, credential harvesting

TA4922 might use a remote access Trojan (RAT), like ValleyRAT or Atlas RAT, to access targeted systems, or legitimate remote monitoring and management (RMM) software, like AnyDesk. In the latter case, it'll use a loader called RomulusLoader to bring the RMM onto the host system.

Gh0stKCP, which is a UDP-based protocol that ValleyRAT sometimes uses to transport its C2 traffic.

alert tcp-pkt $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response"; ... mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1573, mitre_technique_name Encrypted_Channel; target:src_ip;)

Volume Shadow Copy Manipulation : WMI and COM APIs for potential ransomware staging

ntdll.dll!NtTraceEvent patched with a single 0xc3 byte Defender exclusion commands launched through ShellExecuteA and powershell.exe

T1562.009 | Defense Evasion | Impair Defenses: Safe Mode Boot | 1 | Modifying SafeBoot\Minimal and Network registry keys to ensure MANC.exe executes in Safe Mode.