hancitor | c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9

Analysis

max time kernel
143s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 15:37

Target

bcb2cb4b1013272f4ffd5b4a572d1ba4_JaffaCakes118.dll
Size

153KB
MD5

bcb2cb4b1013272f4ffd5b4a572d1ba4
SHA1

10088466c6a991a67a71392ec93d3cdfc6e5864f
SHA256

c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9
SHA512

e114319901c27d7587e68ca44d5cda9f12ce59b719ad080811ac07de765325c692edd341cea6dd9f75ba80de620e0ce9a2fbc61c060f45ee1a8af3f32936a0e8
SSDEEP

1536:pd8MIMZT8M4FWSclXyID9sp9phaLRgOzl3OZdmzZZRNSWmB416bfQw93JPw5Wval:pybMF8h09HDi8WOzZkqZZD6O3wF3v

Score

10^/10

Family

hancitor

Botnet

2301_983487

http://tariroalz.com/4/forum.php

http://rindicatle.ru/4/forum.php

http://torssestih.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 444	4720	rundll32.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
444	svchost.exe
444	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4720	2372	rundll32.exe	83
PID 2372 wrote to memory of 4720	2372	rundll32.exe	83
PID 2372 wrote to memory of 4720	2372	rundll32.exe	83
PID 4720 wrote to memory of 444	4720	rundll32.exe	94
PID 4720 wrote to memory of 444	4720	rundll32.exe	94
PID 4720 wrote to memory of 444	4720	rundll32.exe	94
PID 4720 wrote to memory of 444	4720	rundll32.exe	94
PID 4720 wrote to memory of 444	4720	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb2cb4b1013272f4ffd5b4a572d1ba4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcb2cb4b1013272f4ffd5b4a572d1ba4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:444

memory/444-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/444-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/444-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/444-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4720-0-0x00000000011D0000-0x00000000011D9000-memory.dmp

Filesize
36KB

Download
memory/4720-4-0x0000000001200000-0x000000000120C000-memory.dmp

Filesize
48KB

Download
memory/4720-5-0x00000000011D0000-0x00000000011D9000-memory.dmp

Filesize
36KB

Download