valak | af5c8ec121ec569be6158eb7f9f1f47de4583ef840f7359faa6f5efef5f6d244

Analysis

Target
SecuriteInfo.com.Trojan.Agent.ESBE.13045.5868.dll
Size 289KB
Sample201109-revvm91nje
SHA256 af5c8ec121ec569be6158eb7f9f1f47de4583ef840f7359faa6f5efef5f6d244
MD5 18ae7841b15c74b36792b37059aa9c4e
SHA1 dac0c76daa68c459a4e873b0a52a507a3134128a
SHA512 cfda64ca015b7c78f8ef7898bfeeac6a38e6e5f983910cfd059394c164dc96a6faba532ea0ca86d1bcda1900bffa588653d2f8374c7b5693350e41c81c26c4a9
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	valak
behavioral2/files/0x000300000001a2df-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1404	1020	rundll32.exe	70
PID 1020 wrote to memory of 1404	1020	rundll32.exe	70
PID 1020 wrote to memory of 1404	1020	rundll32.exe	70
PID 1404 wrote to memory of 188	1404	rundll32.exe	79
PID 1404 wrote to memory of 188	1404	rundll32.exe	79
PID 1404 wrote to memory of 188	1404	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.13045.5868.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.13045.5868.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:188

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1308