valak | a0a2a5c5de14959481b9469a5dc41e5a24bf9d9e4670ff22e2b30d9c5235bf5e | Triage™

Analysis

max time kernel
51s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Valak (5).cab.dll
Size 288KB
Sample201109-eb22grnjhs
SHA256 a0a2a5c5de14959481b9469a5dc41e5a24bf9d9e4670ff22e2b30d9c5235bf5e
MD5 fa99b2d898eed7b28a21628cd927ca83
SHA1 6f2f1f2312228c87ee04f04fa7d172f2385ad878
SHA512 ec26fe63c35a9a5a42a5e81ca0ddb00b529abdd3eed6135f16bd4b7ad3d73594c5315139033d37b032f3dc0b3d359182e7353c7d45aeb012dd32271015ece42c
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	valak
behavioral2/files/0x000300000001a2df-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1872	796	rundll32.exe	69
PID 796 wrote to memory of 1872	796	rundll32.exe	69
PID 796 wrote to memory of 1872	796	rundll32.exe	69
PID 1872 wrote to memory of 1336	1872	rundll32.exe	79
PID 1872 wrote to memory of 1336	1872	rundll32.exe	79
PID 1872 wrote to memory of 1336	1872	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (5).cab.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (5).cab.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:1336

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads