Analysis

  • max time kernel
    153s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 10:32

General

  • Target

    3b7edc6b378860d916e7889ba553d1fd467c905672893a0fd51357cd1a1f2b8a.dll

  • Size

    304KB

  • MD5

    03548d46adf65abe05b9da64b08b8258

  • SHA1

    851319fd8d8a50f6c0c205a58314853ef9d52529

  • SHA256

    3b7edc6b378860d916e7889ba553d1fd467c905672893a0fd51357cd1a1f2b8a

  • SHA512

    f74701533a6a931640d8cd5ca983356ca32351a88dbf283308c9baefad5cd333060ae5a1acaa4071a2de368465795bbb453326b75ac91fb3fa3e7b3f7e5c55d4

Score
10/10

Malware Config

Signatures

  • Valak

    Valak is a JavaScript loader, a link in a chain of distribution of other malware families.

  • Valak JavaScript Loader 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7edc6b378860d916e7889ba553d1fd467c905672893a0fd51357cd1a1f2b8a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7edc6b378860d916e7889ba553d1fd467c905672893a0fd51357cd1a1f2b8a.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
        3⤵
        • Blocklisted process makes network request
        PID:1400
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1892

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\iVIwVADQD.eLxan

      MD5

      bc9ac467126926bfd2782428da6f1a09

      SHA1

      f9d6fbc917446025fb63cc622a117a11544ce34b

      SHA256

      0eab2d2538e95419e764bd23408ad7e0cb830b3df3e3e1a77c71af75e6184dd9

      SHA512

      f82193aa1551794f5fbaeb2f958cf00a2b43ea2f135be338425e677ad99b523bb6f3787348e3e714f23f9c037ad21a4925db9c40b432a5c4da460f46fed8a62c

    • memory/608-54-0x0000000076001000-0x0000000076003000-memory.dmp

      Filesize

      8KB

    • memory/608-55-0x0000000010000000-0x000000001001B000-memory.dmp

      Filesize

      108KB

    • memory/608-56-0x0000000010000000-0x0000000010151000-memory.dmp

      Filesize

      1.3MB

    • memory/608-58-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB