valak | e392d5a3ab3d10f866705a7c8edc5f76f600bda2783f7c8e848cb8d06fbb04d2

Analysis

Target
SecuriteInfo.com.Trojan.Agent.ESBE.10931.26687.dll
Size 289KB
Sample201109-rf3618mrvn
SHA256 e392d5a3ab3d10f866705a7c8edc5f76f600bda2783f7c8e848cb8d06fbb04d2
MD5 70f8f511f1b80e43d0fc2820d2560dbb
SHA1 b7299de306756f6233a203e3afd48a9f8f549a2c
SHA512 008b661222a7ec068756ac44e032a3dd431206e1bfaa15d8a579e7b97d2a629c53f17b4c4ba94090fc61282bf3f357d892f000a5414e6cabe6c5725239be9b29
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	valak
behavioral2/files/0x000300000001a0e3-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1292	580	rundll32.exe	71
PID 580 wrote to memory of 1292	580	rundll32.exe	71
PID 580 wrote to memory of 1292	580	rundll32.exe	71
PID 1292 wrote to memory of 3284	1292	rundll32.exe	79
PID 1292 wrote to memory of 3284	1292	rundll32.exe	79
PID 1292 wrote to memory of 3284	1292	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.10931.26687.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.10931.26687.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:3284

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1340