valak | cfe04f71756d4446175d9c9bf9fc0ad934f44d6a62ecaa2fe2c9e9709f15b0d7

Analysis

Target
8619fbe88a2fd827048d01fadb59a30031c47e9f64885b359ff4bebec099ba11.dll
Size 583KB
Sample201207-d2s57t9yc2
SHA256 8619fbe88a2fd827048d01fadb59a30031c47e9f64885b359ff4bebec099ba11
MD5 f7c6e6ed8266f224bbafd9c63fc18212
SHA1 3f5a977b1da77348f866e8d23e6e6fd4f29c6483
SHA512 75d2736bad9d5591699900a70609add641497297242f26306a52df01d2814b710471010dd4315a535f26c7f90c03b39f8628f6fe800056169b101b52083671d4
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000001a4f4-4.dat	valak
behavioral2/files/0x000600000001a4f4-4.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000001a4f4-4.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 1040	412	rundll32.exe	71
PID 412 wrote to memory of 1040	412	rundll32.exe	71
PID 412 wrote to memory of 1040	412	rundll32.exe	71
PID 1040 wrote to memory of 2380	1040	rundll32.exe	79
PID 1040 wrote to memory of 2380	1040	rundll32.exe	79
PID 1040 wrote to memory of 2380	1040	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8619fbe88a2fd827048d01fadb59a30031c47e9f64885b359ff4bebec099ba11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8619fbe88a2fd827048d01fadb59a30031c47e9f64885b359ff4bebec099ba11.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\xSsGKcUqL.vA_YV
    3⤵
    PID:2380

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1308