hancitor | c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9

Analysis

max time kernel
138s
max time network
138s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18/06/2024, 15:37

Target

bcb2cb4b1013272f4ffd5b4a572d1ba4_JaffaCakes118.dll
Size

153KB
MD5

bcb2cb4b1013272f4ffd5b4a572d1ba4
SHA1

10088466c6a991a67a71392ec93d3cdfc6e5864f
SHA256

c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9
SHA512

e114319901c27d7587e68ca44d5cda9f12ce59b719ad080811ac07de765325c692edd341cea6dd9f75ba80de620e0ce9a2fbc61c060f45ee1a8af3f32936a0e8
SSDEEP

1536:pd8MIMZT8M4FWSclXyID9sp9phaLRgOzl3OZdmzZZRNSWmB416bfQw93JPw5Wval:pybMF8h09HDi8WOzZkqZZD6O3wF3v

Score

10^/10

Family

hancitor

Botnet

2301_983487

http://tariroalz.com/4/forum.php

http://rindicatle.ru/4/forum.php

http://torssestih.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 2372	2968	rundll32.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	svchost.exe
2372	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2968	2860	rundll32.exe	28
PID 2860 wrote to memory of 2968	2860	rundll32.exe	28
PID 2860 wrote to memory of 2968	2860	rundll32.exe	28
PID 2860 wrote to memory of 2968	2860	rundll32.exe	28
PID 2860 wrote to memory of 2968	2860	rundll32.exe	28
PID 2860 wrote to memory of 2968	2860	rundll32.exe	28
PID 2860 wrote to memory of 2968	2860	rundll32.exe	28
PID 2968 wrote to memory of 2372	2968	rundll32.exe	29
PID 2968 wrote to memory of 2372	2968	rundll32.exe	29
PID 2968 wrote to memory of 2372	2968	rundll32.exe	29
PID 2968 wrote to memory of 2372	2968	rundll32.exe	29
PID 2968 wrote to memory of 2372	2968	rundll32.exe	29
PID 2968 wrote to memory of 2372	2968	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb2cb4b1013272f4ffd5b4a572d1ba4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb2cb4b1013272f4ffd5b4a572d1ba4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2372

memory/2372-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2372-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2372-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2372-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2372-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2372-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2968-0-0x0000000000170000-0x0000000000179000-memory.dmp

Filesize
36KB

Download
memory/2968-1-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download
memory/2968-11-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download
memory/2968-10-0x0000000000170000-0x0000000000179000-memory.dmp

Filesize
36KB

Download
memory/2968-7-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download