valak | 260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760a

Analysis

max time kernel
106s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2025, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.dll
Size 562KB
Sample250116-mdsl9awkfw
SHA256 260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760a
MD5 7a0dec1b9d3854b30367a221a5117430
SHA1 c5d9f5fe63cd258a6c3fa6f423d18875b8d64eea
SHA512 0afa794f909e306e462b9ba54e0846dd53757ba2edec2f44f9a8dee4a2afb05201fb95c541fa443a929d3eee678ff6010e523836937a9ad2989ad88d04c5f061
SSDEEP 12288:Zew76RBfeL8GRVAsArkRHLwEQzm8LtnScuK+QZOGOBhYWzod5Cmvq:Zew2RBfeL8GRVAsArk25zm8duCkFmv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

valak discovery loader

Malware Config

Signatures

Valak
Valak is a JavaScript loader, a link in a chain of distribution of other malware families.
loader valak

Valak JavaScript Loader 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023ce7-5.dat	valak_js

Valak JavaScript loader 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023ce7-5.dat	valak

Valak family
valak

Blocklisted process makes network request 2 IoCs

flow	pid	Process
27	4836	wscript.exe
47	4836	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1848	3528	rundll32.exe	85
PID 3528 wrote to memory of 1848	3528	rundll32.exe	85
PID 3528 wrote to memory of 1848	3528	rundll32.exe	85
PID 1848 wrote to memory of 4836	1848	rundll32.exe	95
PID 1848 wrote to memory of 4836	1848	rundll32.exe	95
PID 1848 wrote to memory of 4836	1848	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe //E:jscript "C:\Users\Public\DB_TGfNqo.RJFl_
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:4836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DB_TGfNqo.RJFl_

Path C:\Users\Public\DB_TGfNqo.RJFl_
Size 11KB
SHA256 d785c900d0226c787ab4eaa6ed409f2ee0507b18a2b8182e4f631f22fadd113c
MD5 2207304e71add81999c26eaa15ebbe18
SHA1 68a88e2b71deff00ad5ea7bdcbf65be2e9ca7b20
SHA512 589cffcfb0b6f9f3acb375f02c6b416975796562070baee47f3604729a429e2459e812810cca4855cf4fb1fff70ef8b3f76e617b9f0a87897c8bf3bef8a381c8
SSDEEP 192:uDArMWzTP6cWaSPKALdETW7FM8/EYWRsmYvDT4CnsRcXJsBhar:YArMqicWXPzLMW7FhSMkzRcZsHar
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1848-0-0x000000007517A000-0x000000007517D000-memory.dmp

Download

memory/1848-3-0x00000000750F0000-0x0000000075273000-memory.dmp