valak | 73926cf57488263db6454fecf95436c25aa581ad1c353c135dc3d8e258be2f8d | Triage™

Analysis

max time kernel
149s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
haao15.cab.dll
Size 242KB
Sample201109-1fvxde5t36
SHA256 73926cf57488263db6454fecf95436c25aa581ad1c353c135dc3d8e258be2f8d
MD5 7e040ce0f485ca329566e5b91b4644d2
SHA1 1e9c18f525811890a4c1547e6a66d96becea3820
SHA512 29c28c898c81a1d5ee6c9149fee9c9efc45e7418b0c49aea391ce5991b15ffd488a4fd1110bee9a1cb304a43ccdb1fb7daa86cfa2648d15b4ff7ad93845812fb
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	valak
behavioral2/files/0x000300000001a0e3-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4768	4684	rundll32.exe	71
PID 4684 wrote to memory of 4768	4684	rundll32.exe	71
PID 4684 wrote to memory of 4768	4684	rundll32.exe	71
PID 4768 wrote to memory of 3980	4768	rundll32.exe	79
PID 4768 wrote to memory of 3980	4768	rundll32.exe	79
PID 4768 wrote to memory of 3980	4768	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\haao15.cab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\haao15.cab.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\anFJjtYxH.eB_c_
    3⤵
    PID:3980

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads