Analysis
-
max time kernel
140s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08-07-2024 21:44
General
-
Target
2de9af53069fe83968ff97fdeaffde9f_JaffaCakes118.exe
-
Size
104KB
-
MD5
2de9af53069fe83968ff97fdeaffde9f
-
SHA1
25803f964fecb58aff9d9a901dc2b53ae5879a38
-
SHA256
70d16fb632ff6b12eb08d873bee35d27a82df9f76ec4a21a1c09df7befa6ca8c
-
SHA512
ebc3abc242212a0f0354806dbf0dd1ba2286137ecadad218feeb82a713e62679d26c0c93ccd7385396c719bd204770e041a5bb3af11115d4c487ed1ea704bd10
-
SSDEEP
3072:G7PlpOLapaE3594bjORYE+Z31kjQaaSU:0lUuH5OgYt32jQa
Score
10/10
Malware Config
Extracted
Family
hancitor
Botnet
1604_239543
C2
http://gumousethat.com/4/forum.php
http://henletlighny.ru/4/forum.php
http://kethentantit.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de9af53069fe83968ff97fdeaffde9f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2de9af53069fe83968ff97fdeaffde9f_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
104KB