valak | e69d73208d67db59d8d02c8982426a97a3f76dc2174f15f1fab53f4473310f04

Analysis

Target
SecuriteInfo.com.Trojan.Agent.ESBE.10784.16586.dll
Size 289KB
Sample201109-xpre7ynm86
SHA256 e69d73208d67db59d8d02c8982426a97a3f76dc2174f15f1fab53f4473310f04
MD5 fc480a72e6482e65a429ffab8362add6
SHA1 415d5c5d4a51f51be3245780214d45b9a14cfae6
SHA512 e507c4d8a504f9ad09b85f1ebdd0a83ca876a4fd2e3a431612029bfbaae3117809291b030c47fb7cb45116f8307582f19b9ed2037d59dd4a6a8ebd979f2474be
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	valak
behavioral2/files/0x000300000001a0e3-2.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-2.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 1380	676	rundll32.exe	69
PID 676 wrote to memory of 1380	676	rundll32.exe	69
PID 676 wrote to memory of 1380	676	rundll32.exe	69
PID 1380 wrote to memory of 940	1380	rundll32.exe	80
PID 1380 wrote to memory of 940	1380	rundll32.exe	80
PID 1380 wrote to memory of 940	1380	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.10784.16586.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.ESBE.10784.16586.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\CCGYPWTwr.iySAE
    3⤵
    PID:940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2240