valak | 7c595d596ff5d190ebc057e41424a433e592d3f894fb913e7722eda0cba3913d | Triage™

Analysis

max time kernel
56s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Valak (2).cab.dll
Size 288KB
Sample201109-js23g2hf36
SHA256 7c595d596ff5d190ebc057e41424a433e592d3f894fb913e7722eda0cba3913d
MD5 eb97ca8128b30794d579d5e8dadc9e81
SHA1 fbd0647d854dee4943951a058570f0455cd59db5
SHA512 61407ffc40309112cda90e5b48cc54545b3c2184a31a2bddb75ac052437b0181b82b9afa294e91aeb3aa01767d277be4c15f95d0236520c77c446673c9fab321
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	valak
behavioral2/files/0x000300000001a0e3-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1016	576	rundll32.exe	70
PID 576 wrote to memory of 1016	576	rundll32.exe	70
PID 576 wrote to memory of 1016	576	rundll32.exe	70
PID 1016 wrote to memory of 4000	1016	rundll32.exe	79
PID 1016 wrote to memory of 4000	1016	rundll32.exe	79
PID 1016 wrote to memory of 4000	1016	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (2).cab.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Valak (2).cab.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:4000

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads