Analysis
-
max time kernel
61s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:42
Static task
static1
Behavioral task
behavioral1
Sample
Valak (6).cab.dll
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
Valak (6).cab.dll
-
Size
288KB
-
MD5
c94194485cd6ee22cd5b71f1418a8c78
-
SHA1
2f37f11e26b60b4b7b7ac3fb54093c15af639840
-
SHA256
1d07b32a7e2d4cc14cdd24795e40c66aa4253f8fdd810ba43ac33e2ae2107c0b
-
SHA512
ebba08662b9bcf70169fdf3dc772f1af8b16ec20f8d15e16f5a9fa97bfd7804759363cff13c145cea0f85dc595b9571905f4f5f495960194c9e1ab13f717c744
Malware Config
Signatures
-
Valak JavaScript Loader 2 IoCs
Processes:
resource yara_rule C:\Users\Public\CCGYPWTwr.iySAE valak C:\Users\Public\CCGYPWTwr.iySAE valak_js -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule C:\Users\Public\CCGYPWTwr.iySAE js -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3408 wrote to memory of 3648 3408 rundll32.exe rundll32.exe PID 3408 wrote to memory of 3648 3408 rundll32.exe rundll32.exe PID 3408 wrote to memory of 3648 3408 rundll32.exe rundll32.exe PID 3648 wrote to memory of 1100 3648 rundll32.exe wscript.exe PID 3648 wrote to memory of 1100 3648 rundll32.exe wscript.exe PID 3648 wrote to memory of 1100 3648 rundll32.exe wscript.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (6).cab.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (6).cab.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\wscript.exewscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE3⤵PID:1100
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2652
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6df4cb0a89bdabcf858e7e407e3975f5
SHA1f41a9efe9f3cdce394893d90f564bb26e3cdd494
SHA256c65b67bfe6a5acf6ebfb7f327a6ce8f93bfe5ec579fe783f611a73ce031f7232
SHA512a49817c5b27a75263a57398a17f838e935660d554e6b36d8e11ec20817fd08b532851b527c7255d50556d85e1fa985ed0d766d7103f6178ab8ef8bab561b1a41