Analysis

  • max time kernel
    136s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 14:32

General

  • Target

    39855f213e82660888352fe31f529dc9_JaffaCakes118.dll

  • Size

    80KB

  • MD5

    39855f213e82660888352fe31f529dc9

  • SHA1

    97aceb9ed8a836ecb5ee85aedf54056185191923

  • SHA256

    4ba17b5f96d3d264ce6422ab0d2712ae82e8acb68dabf8430f66006b30e3fa13

  • SHA512

    02be4d418f265cff7800de61c7ada7273136aa3cdb6f379eaa4ef46982a9d8682a6afe2704d83084d1adbff121751eb16215b2ba9aec597a0bf567f6840bcc1e

  • SSDEEP

    768:+MFz18Cn+Im/aVtQeUMQ9adrea2Vru5dCnrcqbGfzHWxZ:3/m/2tFUMRdrX2VydCrhSfyxZ

Score
10/10

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2376-0-0x0000000010000000-0x0000000010014000-memory.dmp

    Filesize

    80KB

  • memory/2376-17-0x0000000010000000-0x0000000010014000-memory.dmp

    Filesize

    80KB