valak | 2979faddfbed3bc999071245a94efab628ed7824f09e12e04461b4f2f0519648 | Triage™

Analysis

max time kernel
124s
max time network
104s
platform
windows10_x64
resource
win10v20201028
submitted
17/12/2020, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hanw1_.dll
Size 189KB
Sample201217-q14f3j1jen
SHA256 2979faddfbed3bc999071245a94efab628ed7824f09e12e04461b4f2f0519648
MD5 232d23bd821b2b22f2e6a05593ea5eda
SHA1 1d64249d04182f9c768a162f11d30164ccccbf79
SHA512 1498a45bf47919921c8c1fd44a94eedda95840de938eb09c9f4a001c4fa71096ee0f114e7845f98b19c025ef57ba1c724e90d67153c5ccf72436c2ebefa9e5cd
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000000068f-4.dat	valak_js

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000000068f-4.dat	js

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1232	1160	rundll32.exe	43
PID 1160 wrote to memory of 1232	1160	rundll32.exe	43
PID 1160 wrote to memory of 1232	1160	rundll32.exe	43
PID 1232 wrote to memory of 3552	1232	rundll32.exe	76
PID 1232 wrote to memory of 3552	1232	rundll32.exe	76
PID 1232 wrote to memory of 3552	1232	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hanw1_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hanw1_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //E:jscript "C:\Users\Public\RBsMZPc_g.zCbzj"
    3⤵
    PID:3552

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3100

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4000

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads