hancitor | 09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0

Analysis

max time kernel
137s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 02:12

Target

8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll
Size

30KB
MD5

8c918dc7b09518710e4c8270e2f2778a
SHA1

6703c8e8f4e1a828d11f6899ed3dcaa149bd5172
SHA256

09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0
SHA512

ab46a739a18c471ad95bfe26c63c50d3f37766969d450d821cea83e5f0f3fb013a9291864bee86ed6aeb25a126dd59c099e81b4135c63c57b2bf7ee0010a0b23
SSDEEP

768:gKsRswq8lczikS02wYnElSMYVarkrKFZVPqN9:ZDOMYWfkrKLwN

Score

10^/10

Family

hancitor

Botnet

1812_78213

http://unceliet.com/4/forum.php

http://fitiondice.ru/4/forum.php

http://wordlegromin.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 2012	2128	rundll32.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2012	svchost.exe
2012	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2128	2028	rundll32.exe	28
PID 2028 wrote to memory of 2128	2028	rundll32.exe	28
PID 2028 wrote to memory of 2128	2028	rundll32.exe	28
PID 2028 wrote to memory of 2128	2028	rundll32.exe	28
PID 2028 wrote to memory of 2128	2028	rundll32.exe	28
PID 2028 wrote to memory of 2128	2028	rundll32.exe	28
PID 2028 wrote to memory of 2128	2028	rundll32.exe	28
PID 2128 wrote to memory of 2012	2128	rundll32.exe	29
PID 2128 wrote to memory of 2012	2128	rundll32.exe	29
PID 2128 wrote to memory of 2012	2128	rundll32.exe	29
PID 2128 wrote to memory of 2012	2128	rundll32.exe	29
PID 2128 wrote to memory of 2012	2128	rundll32.exe	29
PID 2128 wrote to memory of 2012	2128	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2012

memory/2012-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2012-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download