hancitor | abd33ae587a1e765da811dccbabaa9548613b4c4d89eb344f5d1ca0173b9590a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 08:11

Target

f0a292819d13490468b78d60b1a719f0_JaffaCakes118.dll
Size

348KB
MD5

f0a292819d13490468b78d60b1a719f0
SHA1

8faa644b5ee5f9a009268bc7c8dcb9f66e5ced18
SHA256

abd33ae587a1e765da811dccbabaa9548613b4c4d89eb344f5d1ca0173b9590a
SHA512

8c143d9342f4c11abe59dd9c101ba3c6772fc7af21b1f6c6a520270113ee823fe4c0b2480d743cb5f32050856531b01e0e006b1dc5d50d91b82e52322bf48d1a
SSDEEP

6144:kurKzLBOhPhBrcARdn1mBWmSlBGHUXyOUrU7TAOe6hXPSSzuCW0:kurULgh5BvdsycHAhH06h5XW0

Score

10^/10

Family

hancitor

Botnet

0109_iqwnm

http://asinvotheir.com/8/forum.php

http://ditrismale.ru/8/forum.php

http://clatrommon.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

29 3024 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

3024 rundll32.exe
3024 rundll32.exe
3024 rundll32.exe
3024 rundll32.exe

flow	pid	process
29	3024	rundll32.exe

flow	ioc
28	api.ipify.org

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4472 wrote to memory of 3024	4472	rundll32.exe	rundll32.exe
PID 4472 wrote to memory of 3024	4472	rundll32.exe	rundll32.exe
PID 4472 wrote to memory of 3024	4472	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0a292819d13490468b78d60b1a719f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0a292819d13490468b78d60b1a719f0_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3024

memory/3024-0-0x0000000075370000-0x00000000753E1000-memory.dmp

Filesize
452KB

Download
memory/3024-1-0x0000000075370000-0x00000000753E1000-memory.dmp

Filesize
452KB

Download
memory/3024-2-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/3024-3-0x0000000075370000-0x00000000753E1000-memory.dmp

Filesize
452KB

Download