hancitor | 09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 02:12

Target
8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll
Size 30KB
Sample240602-cna5vafd5v
SHA256 09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0
MD5 8c918dc7b09518710e4c8270e2f2778a
SHA1 6703c8e8f4e1a828d11f6899ed3dcaa149bd5172
SHA512 ab46a739a18c471ad95bfe26c63c50d3f37766969d450d821cea83e5f0f3fb013a9291864bee86ed6aeb25a126dd59c099e81b4135c63c57b2bf7ee0010a0b23
SSDEEP 768:gKsRswq8lczikS02wYnElSMYVarkrKFZVPqN9:ZDOMYWfkrKLwN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4208 set thread context of 2200	4208	rundll32.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4208	4828	rundll32.exe	81
PID 4828 wrote to memory of 4208	4828	rundll32.exe	81
PID 4828 wrote to memory of 4208	4828	rundll32.exe	81
PID 4208 wrote to memory of 2200	4208	rundll32.exe	82
PID 4208 wrote to memory of 2200	4208	rundll32.exe	82
PID 4208 wrote to memory of 2200	4208	rundll32.exe	82
PID 4208 wrote to memory of 2200	4208	rundll32.exe	82
PID 4208 wrote to memory of 2200	4208	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2200

memory/2200-0-0x00000000006A0000-0x00000000006A9000-memory.dmp

Download

memory/2200-2-0x00000000006A0000-0x00000000006A9000-memory.dmp

Download

memory/2200-3-0x00000000006A0000-0x00000000006A9000-memory.dmp

Download

memory/2200-4-0x00000000006A0000-0x00000000006A9000-memory.dmp

Download