hancitor | abd33ae587a1e765da811dccbabaa9548613b4c4d89eb344f5d1ca0173b9590a

Analysis

max time kernel
145s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 08:11

Target

f0a292819d13490468b78d60b1a719f0_JaffaCakes118.dll
Size

348KB
MD5

f0a292819d13490468b78d60b1a719f0
SHA1

8faa644b5ee5f9a009268bc7c8dcb9f66e5ced18
SHA256

abd33ae587a1e765da811dccbabaa9548613b4c4d89eb344f5d1ca0173b9590a
SHA512

8c143d9342f4c11abe59dd9c101ba3c6772fc7af21b1f6c6a520270113ee823fe4c0b2480d743cb5f32050856531b01e0e006b1dc5d50d91b82e52322bf48d1a
SSDEEP

6144:kurKzLBOhPhBrcARdn1mBWmSlBGHUXyOUrU7TAOe6hXPSSzuCW0:kurULgh5BvdsycHAhH06h5XW0

Score

10^/10

Family

hancitor

Botnet

0109_iqwnm

http://asinvotheir.com/8/forum.php

http://ditrismale.ru/8/forum.php

http://clatrommon.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	820	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
820	rundll32.exe
820	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0a292819d13490468b78d60b1a719f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0a292819d13490468b78d60b1a719f0_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:820

memory/820-0-0x0000000074680000-0x00000000746F1000-memory.dmp

Filesize
452KB

Download
memory/820-1-0x0000000074680000-0x00000000746F1000-memory.dmp

Filesize
452KB

Download
memory/820-2-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/820-4-0x0000000074680000-0x00000000746F1000-memory.dmp

Filesize
452KB

Download
memory/820-5-0x0000000074680000-0x00000000746F1000-memory.dmp

Filesize
452KB

Download
memory/820-7-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download