Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fff0d984710b43b77622191b7fd37d01_JaffaCakes118.dll
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
General
-
Target
fff0d984710b43b77622191b7fd37d01_JaffaCakes118.dll
-
Size
14KB
-
MD5
fff0d984710b43b77622191b7fd37d01
-
SHA1
ec26e6766dd1008cdd3229c5a64deab575624410
-
SHA256
4b75140254406e6d275c75ab6dda5657e5d941eeb96cfcc38195b878fd4023bc
-
SHA512
4daf8c3acb872fd366db889f4e3e7afc2836a5729a4bf8260d8a3d9404742f5195580e50c7f8598a9d075214fade0cd2c663fdddba1f3232419ca706c374ddf0
-
SSDEEP
384:prqfka2vDxru5KyxdCTCIrcHzWoSz9mSbef0an:ba2Vru5dCnrcqbGfzn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/2388-1-0x0000000010000000-0x0000000010013000-memory.dmp family_blackmoon behavioral2/memory/2388-3-0x0000000010000000-0x0000000010013000-memory.dmp family_blackmoon -
Blocklisted process makes network request 54 IoCs
flow pid Process 9 2388 rundll32.exe 17 2388 rundll32.exe 19 2388 rundll32.exe 23 2388 rundll32.exe 24 2388 rundll32.exe 25 2388 rundll32.exe 26 2388 rundll32.exe 29 2388 rundll32.exe 31 2388 rundll32.exe 33 2388 rundll32.exe 34 2388 rundll32.exe 35 2388 rundll32.exe 36 2388 rundll32.exe 37 2388 rundll32.exe 38 2388 rundll32.exe 39 2388 rundll32.exe 48 2388 rundll32.exe 54 2388 rundll32.exe 55 2388 rundll32.exe 56 2388 rundll32.exe 57 2388 rundll32.exe 58 2388 rundll32.exe 59 2388 rundll32.exe 60 2388 rundll32.exe 61 2388 rundll32.exe 62 2388 rundll32.exe 63 2388 rundll32.exe 64 2388 rundll32.exe 68 2388 rundll32.exe 69 2388 rundll32.exe 70 2388 rundll32.exe 71 2388 rundll32.exe 72 2388 rundll32.exe 73 2388 rundll32.exe 74 2388 rundll32.exe 75 2388 rundll32.exe 76 2388 rundll32.exe 77 2388 rundll32.exe 78 2388 rundll32.exe 82 2388 rundll32.exe 83 2388 rundll32.exe 84 2388 rundll32.exe 85 2388 rundll32.exe 86 2388 rundll32.exe 87 2388 rundll32.exe 88 2388 rundll32.exe 89 2388 rundll32.exe 90 2388 rundll32.exe 91 2388 rundll32.exe 92 2388 rundll32.exe 93 2388 rundll32.exe 94 2388 rundll32.exe 95 2388 rundll32.exe 96 2388 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4944 wrote to memory of 2388 4944 rundll32.exe 82 PID 4944 wrote to memory of 2388 4944 rundll32.exe 82 PID 4944 wrote to memory of 2388 4944 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fff0d984710b43b77622191b7fd37d01_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fff0d984710b43b77622191b7fd37d01_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2388
-