valak | 0387ab464a28a94f88f1689a34c69924938b784c13af830b59af0efd6fbb2ea5

Analysis

Target
0387ab464a28a94f88f1689a34c69924938b784c13af830b59af0efd6fbb2ea5.dll
Size 382KB
Sample201109-jce4d72f6x
SHA256 0387ab464a28a94f88f1689a34c69924938b784c13af830b59af0efd6fbb2ea5
MD5 f8c131d55f8d6c2d1b9dba2b6d8def24
SHA1 435ec42fefc05eba0a8005256c815979877d430a
SHA512 b542436917b9c9409f1c0b6349bb744c40431ccb13e9295cc6aa9dcb6bc2867074f0de01b8f89b1d51d761a0dd869d171599d61ff8b4304bbe57fa2f46575dcd
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000000068f-2.dat	valak

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4816	4704	regsvr32.exe	70
PID 4704 wrote to memory of 4816	4704	regsvr32.exe	70
PID 4704 wrote to memory of 4816	4704	regsvr32.exe	70
PID 4816 wrote to memory of 5060	4816	regsvr32.exe	74
PID 4816 wrote to memory of 5060	4816	regsvr32.exe	74
PID 4816 wrote to memory of 5060	4816	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0387ab464a28a94f88f1689a34c69924938b784c13af830b59af0efd6fbb2ea5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0387ab464a28a94f88f1689a34c69924938b784c13af830b59af0efd6fbb2ea5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Admin\AppData\Local\Temp\s3ps.0 "
    3⤵
    PID:5060

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:744

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1168

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1392