valak | 0249b4de8637866590388542aad230bb9cd8dc888ee0d0bf41aaedae274a615b

Analysis

Target
SecuriteInfo.com.Trojan.Agent.ESBE.15932.2861.dll
Size 289KB
Sample201109-9f9f5a576n
SHA256 0249b4de8637866590388542aad230bb9cd8dc888ee0d0bf41aaedae274a615b
MD5 2fe306a2137761a291bc5c82dfc87f26
SHA1 673f1e778488f4bc38a65b6aa6918797f945e138
SHA512 1b4a1bab07756a362eb58c8ded2da62986d49e066af55eff2024a923b9a3497778b859dfbacb29981b59e701943f59016127ae75933ac274643071d6f608f5c0
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	valak
behavioral2/files/0x000300000001a0e3-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1204	1080	rundll32.exe	70
PID 1080 wrote to memory of 1204	1080	rundll32.exe	70
PID 1080 wrote to memory of 1204	1080	rundll32.exe	70
PID 1204 wrote to memory of 2204	1204	rundll32.exe	80
PID 1204 wrote to memory of 2204	1204	rundll32.exe	80
PID 1204 wrote to memory of 2204	1204	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.15932.2861.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.15932.2861.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:2204

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1524