valak | d2e68fe4c321e9a4d4582ec24ee07727ab1bf6cb77fe40132d014e03134c2da7

Analysis

Target
d2e68fe4c321e9a4d4582ec24ee07727ab1bf6cb77fe40132d014e03134c2da7.dll
Size 304KB
Sample220201-k5dlascef2
SHA256 d2e68fe4c321e9a4d4582ec24ee07727ab1bf6cb77fe40132d014e03134c2da7
MD5 fd7bea08621c6b82bdd35f9ee1f87ac9
SHA1 5480ad5f480e456da2c7987b4194528fa0541a11
SHA512 7e1130b94bba640d8fb7b333a05dbd6f397e2c9ee4e48827908c3d8c25b085b8eb314b4aeaf8e9d2fbe2e2cfad3bbebba8b20e3ed7192849e30b91c0b9e5cd04
MD5 SHA1 SHA512

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000125df-60.dat	valak
behavioral1/files/0x00070000000125df-60.dat	valak_js

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1384	wscript.exe
8	1384	wscript.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 836	1620	rundll32.exe	27
PID 1620 wrote to memory of 836	1620	rundll32.exe	27
PID 1620 wrote to memory of 836	1620	rundll32.exe	27
PID 1620 wrote to memory of 836	1620	rundll32.exe	27
PID 1620 wrote to memory of 836	1620	rundll32.exe	27
PID 1620 wrote to memory of 836	1620	rundll32.exe	27
PID 1620 wrote to memory of 836	1620	rundll32.exe	27
PID 836 wrote to memory of 1384	836	rundll32.exe	30
PID 836 wrote to memory of 1384	836	rundll32.exe	30
PID 836 wrote to memory of 1384	836	rundll32.exe	30
PID 836 wrote to memory of 1384	836	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2e68fe4c321e9a4d4582ec24ee07727ab1bf6cb77fe40132d014e03134c2da7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2e68fe4c321e9a4d4582ec24ee07727ab1bf6cb77fe40132d014e03134c2da7.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
    3⤵
    - Blocklisted process makes network request
    PID:1384

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1488

memory/836-55-0x0000000076641000-0x0000000076643000-memory.dmp

Download

memory/836-57-0x0000000010000000-0x0000000010151000-memory.dmp

Download

memory/836-56-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/836-59-0x0000000000180000-0x0000000000181000-memory.dmp

Download