hancitor | 5d70694b5395e40edfa8c08b7727d3ceea9de8b17b789727a9234cd4f7f44ed1

Analysis

Target
Hs52qascx.dll
Size 351KB
Sample210225-fl8299fk8s
SHA256 5d70694b5395e40edfa8c08b7727d3ceea9de8b17b789727a9234cd4f7f44ed1
MD5 4bcf25af987fa12ed441529c4b0293b7
SHA1 6832afc831acf8cb7ab0df76ae140093a4ae961b
SHA512 c0da04d503f98923323400996bcf0147f6f67e3fd8bf245cfda3749cf43e31b9c74b83dbada17b84523eb6f215072a67941edb87e7803f877afa6d6f5c66ba06
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 3 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 4092	1432	rundll32.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1432	rundll32.exe
1432	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1432	1160	rundll32.exe	69
PID 1160 wrote to memory of 1432	1160	rundll32.exe	69
PID 1160 wrote to memory of 1432	1160	rundll32.exe	69
PID 1432 wrote to memory of 4092	1432	rundll32.exe	80
PID 1432 wrote to memory of 4092	1432	rundll32.exe	80
PID 1432 wrote to memory of 4092	1432	rundll32.exe	80
PID 1432 wrote to memory of 4092	1432	rundll32.exe	80
PID 1432 wrote to memory of 4092	1432	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Hs52qascx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Hs52qascx.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    PID:4092

memory/1432-3-0x0000000073FD0000-0x0000000073FDA000-memory.dmp

Download

memory/1432-4-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/4092-5-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4092-7-0x0000000000400000-0x0000000000448000-memory.dmp

Download