valak | be07157a72558e0a546f290a9bb43564f1bb07639485fae36576acf3928fea75

Analysis

max time kernel
149s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 17:13

Target
be07157a72558e0a546f290a9bb43564f1bb07639485fae36576acf3928fea75.dll
Size 300KB
Sample221130-vreasacg2w
SHA256 be07157a72558e0a546f290a9bb43564f1bb07639485fae36576acf3928fea75
MD5 23c133b997598b7216ee97a73658969a
SHA1 459177be22bc18ec9afec7ee38c96c82875975f1
SHA512 d641a169610b85d4cb3f75a7a4e92c95cfc09e3ceb071ac87b9d51c368557f30c696fc0eb94683c7fe60a7f62c171c39c9b8c1e3fda8c84152af9086bb6e4911
SSDEEP 6144:Fa4yruBt1h+NWdLa44OuNmcguxohz3/3wPMiALHG3:WruRh+8gMH/8WLM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

valak Loader

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
Loader valak

Valak JavaScript Loader 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000022e20-138.dat	valak_js

Valak JavaScript loader 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000022e20-138.dat	valak

Blocklisted process makes network request 2 IoCs

flow	pid	Process
30	5096	wscript.exe
55	5096	wscript.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3404	1260	rundll32.exe	78
PID 1260 wrote to memory of 3404	1260	rundll32.exe	78
PID 1260 wrote to memory of 3404	1260	rundll32.exe	78
PID 3404 wrote to memory of 5096	3404	rundll32.exe	81
PID 3404 wrote to memory of 5096	3404	rundll32.exe	81
PID 3404 wrote to memory of 5096	3404	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be07157a72558e0a546f290a9bb43564f1bb07639485fae36576acf3928fea75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be07157a72558e0a546f290a9bb43564f1bb07639485fae36576acf3928fea75.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
    3⤵
    - Blocklisted process makes network request
    PID:5096

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:260

iVIwVADQD.eLxan

Path C:\Users\Public\iVIwVADQD.eLxan
Size 11KB
SHA256 0eab2d2538e95419e764bd23408ad7e0cb830b3df3e3e1a77c71af75e6184dd9
MD5 bc9ac467126926bfd2782428da6f1a09
SHA1 f9d6fbc917446025fb63cc622a117a11544ce34b
SHA512 f82193aa1551794f5fbaeb2f958cf00a2b43ea2f135be338425e677ad99b523bb6f3787348e3e714f23f9c037ad21a4925db9c40b432a5c4da460f46fed8a62c
SSDEEP 192:dJrMWzAP6cWaSPKALdETW7FM8/EYWRs3inYi2DT4CnsRcXJsBhar:dJrMlicWXPzLMW7FhSci6kzRcZsHar
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3404-134-0x0000000010000000-0x0000000010144000-memory.dmp

Download

memory/3404-133-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/3404-136-0x0000000010000000-0x0000000010144000-memory.dmp

Download