Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 14:32
Behavioral task
behavioral1
Sample
39855f213e82660888352fe31f529dc9_JaffaCakes118.dll
Resource
win7-20240708-en
4 signatures
150 seconds
General
-
Target
39855f213e82660888352fe31f529dc9_JaffaCakes118.dll
-
Size
80KB
-
MD5
39855f213e82660888352fe31f529dc9
-
SHA1
97aceb9ed8a836ecb5ee85aedf54056185191923
-
SHA256
4ba17b5f96d3d264ce6422ab0d2712ae82e8acb68dabf8430f66006b30e3fa13
-
SHA512
02be4d418f265cff7800de61c7ada7273136aa3cdb6f379eaa4ef46982a9d8682a6afe2704d83084d1adbff121751eb16215b2ba9aec597a0bf567f6840bcc1e
-
SSDEEP
768:+MFz18Cn+Im/aVtQeUMQ9adrea2Vru5dCnrcqbGfzHWxZ:3/m/2tFUMRdrX2VydCrhSfyxZ
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/2376-0-0x0000000010000000-0x0000000010014000-memory.dmp family_blackmoon behavioral1/memory/2376-17-0x0000000010000000-0x0000000010014000-memory.dmp family_blackmoon -
Blocklisted process makes network request 3 IoCs
flow pid Process 5 2376 rundll32.exe 7 2376 rundll32.exe 9 2376 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2376 3032 rundll32.exe 30 PID 3032 wrote to memory of 2376 3032 rundll32.exe 30 PID 3032 wrote to memory of 2376 3032 rundll32.exe 30 PID 3032 wrote to memory of 2376 3032 rundll32.exe 30 PID 3032 wrote to memory of 2376 3032 rundll32.exe 30 PID 3032 wrote to memory of 2376 3032 rundll32.exe 30 PID 3032 wrote to memory of 2376 3032 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
PID:2376
-