valak | 09f9d0b09945af8d89176503973dac5904cb109faeb369456767273f6ad020f7 | Triage™

Analysis

max time kernel
50s
max time network
104s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Valak (1).cab.dll
Size 288KB
Sample201109-4y2f2cag52
SHA256 09f9d0b09945af8d89176503973dac5904cb109faeb369456767273f6ad020f7
MD5 414b7c1771c2ddfb6fd489c44b705d70
SHA1 200394c55ff5e505ac67768ce531c5c205506b72
SHA512 04b4729ddeeb1de07f2949296b38a690e64a1086155dcdd0d0e9c2a358375e95fa976fe1ba73b4a01630ac357dcd8a3119ba953fc8423a287e0c706f4ddde985
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	valak
behavioral2/files/0x000300000001a2df-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1516	1104	rundll32.exe	70
PID 1104 wrote to memory of 1516	1104	rundll32.exe	70
PID 1104 wrote to memory of 1516	1104	rundll32.exe	70
PID 1516 wrote to memory of 2796	1516	rundll32.exe	80
PID 1516 wrote to memory of 2796	1516	rundll32.exe	80
PID 1516 wrote to memory of 2796	1516	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (1).cab.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (1).cab.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:2796

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads