Analysis

  • max time kernel
    146s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 10:33

General

  • Target

    3a0148e166753487640e4b7d129c3bad7ee3cf8403953b552240d17851bdafc8.dll

  • Size

    523KB

  • MD5

    95f48e694a8beb8fd3a21a0b7ce73aa6

  • SHA1

    6b5e94e8f94905be32eabc56ebf91ebd818dc61a

  • SHA256

    3a0148e166753487640e4b7d129c3bad7ee3cf8403953b552240d17851bdafc8

  • SHA512

    ac8df20bbbc36a77ef795ce047b942d3f0543f4baf92f4b9bf1df5ab8a31e6360c28c496ffbbda79c28408107d9fe9df4912ffd7cf25a532ce439ccd386b00a2

Score
10/10

Malware Config

Signatures

  • Valak

    Valak is a JavaScript loader, a link in a chain of distribution of other malware families.

  • Valak JavaScript Loader 2 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a0148e166753487640e4b7d129c3bad7ee3cf8403953b552240d17851bdafc8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a0148e166753487640e4b7d129c3bad7ee3cf8403953b552240d17851bdafc8.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe //E:jscript "C:\Users\Public\xSsGKcUqL.vA_YV
        3⤵
        • Blocklisted process makes network request
        • Modifies system certificate store
        PID:544
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1756

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\xSsGKcUqL.vA_YV

      MD5

      9bb0250408c43581e7f9977da9c64e36

      SHA1

      10bb73ae8b19a28b833daffd8c89041ca9c58dca

      SHA256

      732a56132c0ec98955de6f53cd6e5ed9d15bcb3ebc42a9f43e0a8b399c496543

      SHA512

      53829569b9737511a18e77f219b91d1681b858ccf0ed5e9bcffb6fe5caf909be7807902681dfb99825bdb7bec9cbd8b840cce945670b69795db3d851f1df442a

    • memory/1492-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

      Filesize

      8KB

    • memory/1492-56-0x0000000075320000-0x00000000753BE000-memory.dmp

      Filesize

      632KB

    • memory/1492-55-0x0000000075320000-0x000000007533B000-memory.dmp

      Filesize

      108KB

    • memory/1492-58-0x0000000000170000-0x0000000000171000-memory.dmp

      Filesize

      4KB