valak | a0a2a5c5de14959481b9469a5dc41e5a24bf9d9e4670ff22e2b30d9c5235bf5e | Triage™

Analysis

max time kernel
55s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Valak (5).cab.dll
Size 288KB
Sample201109-eb22grnjhs
SHA256 a0a2a5c5de14959481b9469a5dc41e5a24bf9d9e4670ff22e2b30d9c5235bf5e
MD5 fa99b2d898eed7b28a21628cd927ca83
SHA1 6f2f1f2312228c87ee04f04fa7d172f2385ad878
SHA512 ec26fe63c35a9a5a42a5e81ca0ddb00b529abdd3eed6135f16bd4b7ad3d73594c5315139033d37b032f3dc0b3d359182e7353c7d45aeb012dd32271015ece42c
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000000f55b-2.dat	valak
behavioral1/files/0x001900000000f55b-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000000f55b-2.dat	js

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1192	1808	rundll32.exe	26
PID 1808 wrote to memory of 1192	1808	rundll32.exe	26
PID 1808 wrote to memory of 1192	1808	rundll32.exe	26
PID 1808 wrote to memory of 1192	1808	rundll32.exe	26
PID 1808 wrote to memory of 1192	1808	rundll32.exe	26
PID 1808 wrote to memory of 1192	1808	rundll32.exe	26
PID 1808 wrote to memory of 1192	1808	rundll32.exe	26
PID 1192 wrote to memory of 1616	1192	rundll32.exe	30
PID 1192 wrote to memory of 1616	1192	rundll32.exe	30
PID 1192 wrote to memory of 1616	1192	rundll32.exe	30
PID 1192 wrote to memory of 1616	1192	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (5).cab.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (5).cab.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:1616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-3-0x00000000025D0000-0x00000000025D4000-memory.dmp

Download