valak | a362a9d9b6ca4c8d3c0056bd5c7aebb1d3d43ce4dbf9bb6a757949188d16ea5d | Triage™

Analysis

max time kernel
143s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cennc189.exe_.dll
Size 185KB
Sample201109-8dcr6lwtts
SHA256 a362a9d9b6ca4c8d3c0056bd5c7aebb1d3d43ce4dbf9bb6a757949188d16ea5d
MD5 34321eeeb4e0d2f380647220a60dee89
SHA1 3401265237544acb0351acde657523601cbc0f39
SHA512 adb7fdc3c957aa3c1a2ed9b611ef7c44dba81a03d8ffa3f81dae2dcd17b091a7ba1462a22e727522ef33d4e2ba5d2e08b6608c952de195b512d43f8ba9493e86
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	valak
behavioral2/files/0x000300000001a2df-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 3264	4020	regsvr32.exe	70
PID 4020 wrote to memory of 3264	4020	regsvr32.exe	70
PID 4020 wrote to memory of 3264	4020	regsvr32.exe	70
PID 3264 wrote to memory of 3248	3264	regsvr32.exe	78
PID 3264 wrote to memory of 3248	3264	regsvr32.exe	78
PID 3264 wrote to memory of 3248	3264	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cennc189.exe_.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cennc189.exe_.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\anFJjtYxH.eB_c_
    3⤵
    PID:3248

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1476

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:744

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads