ValleyRAT via Signed Overwolf Sideloading + SilkParasite SpiceRAT C2 Cluster: OTX Pulse Analysis — Enterprise Detection Pack

---
title: DLL Sideloading via Signed Overwolf Binary - ValleyRAT Loader
id: 9f3a1c2e-7b4d-4e1a-a5c6-20260917valr
status: experimental
description: Detects a signed Overwolf executable loading a DLL from a non-standard path, consistent with ValleyRAT tax-phishing sideload chain (ZIP archive with signed binary + hidden malicious DLL).
author: Security Arsenal Threat Intel
date: 2026/09/17
references:
    - https://www.forcepoint.com/blog/x-labs/valleyrat-overwolf-sideload-tax-scam
logsource:
    category: image_load
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\Overwolf.exe'
    selection_dll_path:
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
            - '\AppData\Roaming\'
            - '\Users\Public\'
    filter_signed:
        Signed: 'true'
        ImageLoaded|endswith:
            - '\Overwolf.dll'
    condition: selection_parent and selection_dll_path and not filter_signed
falsepositives:
    - Legitimate Overwolf updates loading from install directory
level: high
tags:
    - attack.defense_evasion
    - attack.t1574.002
---
title: Process Hollowing by Reflectively Loaded Payload
id: 2b8e4d1f-6c3a-4f2b-b7d8-20260917holl
status: experimental
description: Detects creation of suspended processes followed by memory write and thread hijack patterns consistent with ValleyRAT process hollowing after reflective load.
author: Security Arsenal Threat Intel
date: 2026/09/17
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Overwolf.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    selection_child:
        Image|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\dllhost.exe'
            - '\notepad.exe'
    selection_flag:
        CommandLine|contains: ''
    condition: selection_parent and selection_child
falsepositives:
    - Rare; legitimate software rarely spawns hollowable hosts from game-overlay binaries
level: critical
tags:
    - attack.defense_evasion
    - attack.t1055.012
    - attack.t1620
---
title: SilkParasite SpiceRAT C2 Network Communication
id: 4c7f2a9b-1d5e-4c8f-c9a1-20260917silk
status: experimental
description: Detects outbound connections to known SilkParasite SpiceRAT/NodeEdgeRAT/NomadRAT/BloodAlchemy C2 infrastructure active late 2025 through August 2026.
author: Security Arsenal Threat Intel
date: 2026/09/17
references:
    - https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '46.30.188.54'
            - '45.67.230.185'
            - '2.58.14.95'
            - '193.29.59.248'
            - '185.243.112.253'
    selection_domain:
        DestinationHostname|contains:
            - 'mfa-uz.com'
            - 'kginfocom.com'
            - 'natcommunzu.com'
    condition: 1 of selection_*
falsepositives:
    - None expected; infrastructure is dedicated C2
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

// SilkParasite + ValleyRAT unified hunt - Microsoft Sentinel
// 1) Network hits to SilkParasite C2 (last 90 days for retro analysis)
let C2IPs = dynamic(["46.30.188.54", "45.67.230.185", "2.58.14.95", "193.29.59.248", "185.243.112.253"]);
let C2Domains = dynamic(["mfa-uz.com", "kginfocom.com", "natcommunzu.com"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteIP in (C2IPs) or RemoteUrl has_any (C2Domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
// 2) Overwolf sideload execution - signed binary launched from user-writable paths
let SideloadHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "Overwolf.exe"
| where FolderPath has_any (@"\AppData\", @"\Downloads\", @"\Temp\", @"\Users\Public\")
| project TimeGenerated, DeviceName, AccountName, FolderPath, ProcessCommandLine, SHA256;
// 3) Hash correlation for ValleyRAT artifacts
let ValleyHashes = dynamic(["2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d", "315bda377beafb746f1c2f4fba430867", "62e3ba37a23669139a222cd43ec2b202277a4030", "061f3e304c65f3f062f2aacc41b6d6f8a4f43816", "07846091fdeb1011cbd80d9ca45fd7dcb40b5c40", "2d830905581ae5c29d1e6bad27c6b63a097f79d7", "7de942da8993a45a5a7547de0a883f9b13f2f71c", "ab530af5603ce3f98b51b3c6f612074e020f572e"]);
let HashHits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in (ValleyHashes) or SHA1 in (ValleyHashes) or MD5 in (ValleyHashes)
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, ActionType;
NetHits
| union SideloadHits
| union HashHits
| sort by TimeGenerated desc

# Security Arsenal - ValleyRAT & SilkParasite Endpoint IOC Hunt
# Run elevated on suspected endpoints or deploy via RMM/Intune remediation
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. Known malicious file hashes (ValleyRAT chain) ---
$badHashes = @(
    '2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d'
)
$searchPaths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\Users\Public", "$env:APPDATA", "$env:LOCALAPPDATA")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
        if ($badHashes -contains $h.ToLower()) {
            $report += [PSCustomObject]@{Type='HashMatch'; Detail=$_.FullName; Hash=$h}
        }
    }
}

# --- 2. Overwolf binary in anomalous locations (sideload staging) ---
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -Filter 'Overwolf.exe' -ErrorAction SilentlyContinue | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        $report += [PSCustomObject]@{Type='OverwolfAnomaly'; Detail="$($_.FullName) | Signed: $($sig.Status)"; Hash=(Get-FileHash $_.FullName -Algorithm SHA256).Hash}
    }
}

# --- 3. Hidden companion files (malicious DLL + encrypted binary pattern) ---
Get-ChildItem -Path $searchPaths -Recurse -Force -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Attributes -match 'Hidden' -and $_.Extension -in '.dll','.dat','.bin','.tmp' } |
    ForEach-Object { $report += [PSCustomObject]@{Type='HiddenPayload'; Detail=$_.FullName; Hash=(Get-FileHash $_.FullName -Algorithm SHA256).Hash} }

# --- 4. Persistence: Run keys with suspicious entries ---
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'Overwolf|Temp|AppData|Public' -and $_.Name -notmatch '^PS'
        } | ForEach-Object {
            $report += [PSCustomObject]@{Type='Persistence'; Detail="$key :: $($_.Name) = $($_.Value)"; Hash='N/A'}
        }
    }
}

# --- 5. Persistence: Scheduled tasks pointing to user-writable paths ---
Get-ScheduledTask | ForEach-Object {
    $action = $_.Actions.Execute
    if ($action -match 'Overwolf|AppData|Temp|Public') {
        $report += [PSCustomObject]@{Type='ScheduledTask'; Detail="$($_.TaskName) -> $action"; Hash='N/A'}
    }
}

# --- 6. Active connections to SilkParasite C2 ---
$c2 = @('46.30.188.54','45.67.230.185','2.58.14.95','193.29.59.248','185.243.112.253')
Get-NetTCPConnection | Where-Object { $c2 -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    $report += [PSCustomObject]@{Type='C2Connection'; Detail="$($_.RemoteAddress):$($_.RemotePort) by $proc (PID $($_.OwningProcess))"; Hash='N/A'}
}

# --- 7. DNS cache check for SilkParasite domains ---
Get-DnsClientCache | Where-Object { $_.Entry -match 'mfa-uz\.com|kginfocom\.com|natcommunzu\.com' } | ForEach-Object {
    $report += [PSCustomObject]@{Type='DNSCache'; Detail="$($_.Entry) -> $($_.Data)"; Hash='N/A'}
}

if ($report.Count -gt 0) {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path "$env:TEMP\SA_ThreatHunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) suspicious artifacts found. CSV exported. ISOLATE HOST and escalate to IR." -ForegroundColor Red
} else {
    Write-Host "[+] No ValleyRAT/SilkParasite indicators found on this host." -ForegroundColor Green
}