valak | de342d1a4e8dd15037b9b5e859bb57e2e8db8987957cc232ce545db5610ce0e3

Analysis

Target
lfahe1.cab.dll
Size 523KB
Sample201109-4ry1jth3zn
SHA256 de342d1a4e8dd15037b9b5e859bb57e2e8db8987957cc232ce545db5610ce0e3
MD5 4f74df55ff11ae52b59a5ae086593347
SHA1 b0f465a36e86e11ce00756e7e81b679bd9f98c29
SHA512 4a0bd09d0428a0df5a675d74d2fe40e4c05c74a78bd34dcb1bb5dd23f1da70e0ee2ac0f4de04cb8c19478065835c90b8e9373579c054786c98ef3896d772a3e2
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2456 created 1192	2456	WerFault.exe	71

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	valak
behavioral2/files/0x000300000001a0e3-2.dat	valak_js

ServiceHost packer 4 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/1192-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1192-6-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1192-7-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/1192-5-0x0000000000000000-mapping.dmp	servicehost

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	js

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	1192	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1192	428	rundll32.exe	71
PID 428 wrote to memory of 1192	428	rundll32.exe	71
PID 428 wrote to memory of 1192	428	rundll32.exe	71
PID 1192 wrote to memory of 2320	1192	rundll32.exe	80
PID 1192 wrote to memory of 2320	1192	rundll32.exe	80
PID 1192 wrote to memory of 2320	1192	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lfahe1.cab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lfahe1.cab.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\xSsGKcUqL.vA_YV
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 680
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2456

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:640

memory/2456-3-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/2456-9-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download