Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 14:32
Behavioral task
behavioral1
Sample
39855f213e82660888352fe31f529dc9_JaffaCakes118.dll
Resource
win7-20240708-en
4 signatures
150 seconds
General
-
Target
39855f213e82660888352fe31f529dc9_JaffaCakes118.dll
-
Size
80KB
-
MD5
39855f213e82660888352fe31f529dc9
-
SHA1
97aceb9ed8a836ecb5ee85aedf54056185191923
-
SHA256
4ba17b5f96d3d264ce6422ab0d2712ae82e8acb68dabf8430f66006b30e3fa13
-
SHA512
02be4d418f265cff7800de61c7ada7273136aa3cdb6f379eaa4ef46982a9d8682a6afe2704d83084d1adbff121751eb16215b2ba9aec597a0bf567f6840bcc1e
-
SSDEEP
768:+MFz18Cn+Im/aVtQeUMQ9adrea2Vru5dCnrcqbGfzHWxZ:3/m/2tFUMRdrX2VydCrhSfyxZ
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/4636-0-0x0000000010000000-0x0000000010014000-memory.dmp family_blackmoon behavioral2/memory/4636-1-0x0000000010000000-0x0000000010014000-memory.dmp family_blackmoon -
Blocklisted process makes network request 26 IoCs
flow pid Process 16 4636 rundll32.exe 19 4636 rundll32.exe 20 4636 rundll32.exe 21 4636 rundll32.exe 22 4636 rundll32.exe 23 4636 rundll32.exe 32 4636 rundll32.exe 35 4636 rundll32.exe 39 4636 rundll32.exe 40 4636 rundll32.exe 44 4636 rundll32.exe 45 4636 rundll32.exe 46 4636 rundll32.exe 47 4636 rundll32.exe 48 4636 rundll32.exe 49 4636 rundll32.exe 50 4636 rundll32.exe 57 4636 rundll32.exe 58 4636 rundll32.exe 59 4636 rundll32.exe 60 4636 rundll32.exe 61 4636 rundll32.exe 62 4636 rundll32.exe 63 4636 rundll32.exe 66 4636 rundll32.exe 68 4636 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2636 wrote to memory of 4636 2636 rundll32.exe 83 PID 2636 wrote to memory of 4636 2636 rundll32.exe 83 PID 2636 wrote to memory of 4636 2636 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
PID:4636
-