hancitor | 5d70694b5395e40edfa8c08b7727d3ceea9de8b17b789727a9234cd4f7f44ed1

Analysis

Target

Hs52qascx.dll
Size

351KB
MD5

4bcf25af987fa12ed441529c4b0293b7
SHA1

6832afc831acf8cb7ab0df76ae140093a4ae961b
SHA256

5d70694b5395e40edfa8c08b7727d3ceea9de8b17b789727a9234cd4f7f44ed1
SHA512

c0da04d503f98923323400996bcf0147f6f67e3fd8bf245cfda3749cf43e31b9c74b83dbada17b84523eb6f215072a67941edb87e7803f877afa6d6f5c66ba06

Score

10^/10

Family

hancitor

Botnet

2502_ser3402

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

7 1412 rundll32.exe
9 1412 rundll32.exe
11 1412 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1412 set thread context of 1076 1412 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1412 rundll32.exe
1412 rundll32.exe

flow	ioc
6	api.ipify.org

description	pid	process	target process
PID 1412 set thread context of 1076	1412	rundll32.exe	svchost.exe

pid	process
1412	rundll32.exe
1412	rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1412	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1412	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1412	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1412	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1412	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1412	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1412	1924	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 1076	1412	rundll32.exe	svchost.exe
PID 1412 wrote to memory of 1076	1412	rundll32.exe	svchost.exe
PID 1412 wrote to memory of 1076	1412	rundll32.exe	svchost.exe
PID 1412 wrote to memory of 1076	1412	rundll32.exe	svchost.exe
PID 1412 wrote to memory of 1076	1412	rundll32.exe	svchost.exe
PID 1412 wrote to memory of 1076	1412	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Hs52qascx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

memory/544-6-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

Filesize
2.5MB

Download
memory/1076-7-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1076-8-0x0000000000401480-mapping.dmp

Download
memory/1076-10-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1412-2-0x0000000000000000-mapping.dmp

Download
memory/1412-3-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1412-4-0x0000000074FC0000-0x0000000074FCA000-memory.dmp

Filesize
40KB

Download
memory/1412-5-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download