hancitor | 34636f51f1f6be19912cbebdcb4f9eed873a42ffa05e0ad3b00949e57a814cf8

Analysis

Target

W0rd.dll
Size

329KB
MD5

8785d193a5f9fbc93169b4b36ac4531d
SHA1

19d5cf757875b3de0d65c7e36f2f552c57d2cb93
SHA256

34636f51f1f6be19912cbebdcb4f9eed873a42ffa05e0ad3b00949e57a814cf8
SHA512

bae1e03030caa43b8e5b5d5eaa912aede9bb545a9ad8dddec3736f67e43a0c30ad00392733fcccda8c1c9b5143dfe2290504be2ec74a198f2a35111381728b06

Score

10^/10

Family

hancitor

Botnet

0402_pogi

http://feirecropl.com/8/forum.php

http://oresteseu.ru/8/forum.php

http://respoishis.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

15 1320 rundll32.exe
17 1320 rundll32.exe
19 1320 rundll32.exe
20 1320 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1320 rundll32.exe
1320 rundll32.exe
1320 rundll32.exe
1320 rundll32.exe

flow	ioc
14	api.ipify.org

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1152 wrote to memory of 1320	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1320	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1320	1152	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 812	1320	rundll32.exe	svchost.exe
PID 1320 wrote to memory of 812	1320	rundll32.exe	svchost.exe
PID 1320 wrote to memory of 812	1320	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\W0rd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

memory/1320-2-0x0000000000000000-mapping.dmp

Download
memory/1320-3-0x0000000073880000-0x000000007388A000-memory.dmp

Filesize
40KB

Download
memory/1320-4-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download