ValleyRAT masquerading as adware

MITRE Techniques

• [T1218 ] System Binary Proxy Execution – The attackers likely planned to invoke the malicious RunDLL function via a trusted binary such as rundll32 to execute code under a legitimate process (‘we suspect the attackers intended to invoke it manually via rundll32’).
• [T1068 ] Exploitation for Privilege Escalation – The malware attempts to gain elevated rights by relaunching with runas when the user is not an administrator (‘attempts to obtain administrator privileges by using the runas utility’).
• [T1112 ] Modify Registry – It disables Windows Defender and sets autorun-related persistence through registry changes (‘uses the DisableAntiSpyware registry key’ and ‘adds it to the registry’s autorun entries’).
• [T1547.001 ] Registry Run Keys / Startup Folder – Persistence is established by dropping a file into the user startup folder and adding autorun entries (‘drops a file with the corresponding extension in … Start MenuProgramsStartup’).
• [T1574.001 ] DLL Search Order Hijacking – The attackers use a malicious libcef.dll loaded alongside a signed application to execute their code (‘carry out DLL sideloading’).
• [T1055.012 ] Process Hollowing – When loading shellcode modules, the backdoor hollowed svchost to run the payload (‘uses process hollowing with svchost to launch the module’).
• [T1057 ] Process Discovery – The malware checks which process the DLL is running inside to choose the payload (‘determines which process the DLL has been loaded into’).
• [T1082 ] System Information Discovery – ValleyRAT gathers host, OS, CPU, disk, graphics, language, and system path details (‘collects system information, including…’).
• [T1056.001 ] Keylogging – The backdoor tracks keystrokes and focused window activity using DirectInput8 (‘it tracks keystrokes and the currently focused window’).
• [T1115 ] Clipboard Data – It captures clipboard contents and stores them on disk (‘It also captures clipboard contents’).
• [T1012 ] Query Registry – It reads configuration and system-related information during execution, including registry-based startup behavior (‘adds it to the registry’s autorun entries’).
• [T1059 ] Command and Scripting Interpreter – The malware uses utilities and command-driven actions such as runas and remote command handling (‘uses the runas utility’ and ‘On command, the backdoor can perform the actions’).
• [T1105 ] Ingress Tool Transfer – It downloads additional modules from C2 or a third-party location before executing them (‘the backdoor downloads the file at that link and executes it’).
• [T1027 ] Obfuscated Files or Information – The configuration string is reversed to hide its contents (‘the attackers wrote the string in reverse’).
• [T1070.001 ] Clear Windows Event Logs – The backdoor can wipe logs as one of its remote commands (‘Wiping logs’).