hancitor | 5d70694b5395e40edfa8c08b7727d3ceea9de8b17b789727a9234cd4f7f44ed1

General

Target

Hs52qascx.dll
Size

351KB
MD5

4bcf25af987fa12ed441529c4b0293b7
SHA1

6832afc831acf8cb7ab0df76ae140093a4ae961b
SHA256

5d70694b5395e40edfa8c08b7727d3ceea9de8b17b789727a9234cd4f7f44ed1
SHA512

c0da04d503f98923323400996bcf0147f6f67e3fd8bf245cfda3749cf43e31b9c74b83dbada17b84523eb6f215072a67941edb87e7803f877afa6d6f5c66ba06

Score

10^/10

hancitor 2502_ser3402 downloader

Malware Config

Extracted

Family

hancitor

Botnet

2502_ser3402

C2

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

6 1504 rundll32.exe
9 1504 rundll32.exe
11 1504 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1504 set thread context of 616 1504 rundll32.exe svchost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

980 616 WerFault.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

rundll32.exeWerFault.exe

pid process

1504 rundll32.exe
1504 rundll32.exe
980 WerFault.exe
980 WerFault.exe
980 WerFault.exe
980 WerFault.exe
980 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 980 WerFault.exe

flow	pid	process
6	1504	rundll32.exe
9	1504	rundll32.exe
11	1504	rundll32.exe

flow	ioc
5	api.ipify.org

description	pid	process	target process
PID 1504 set thread context of 616	1504	rundll32.exe	svchost.exe

pid	pid_target	process	target process
980	616	WerFault.exe	svchost.exe

pid	process
1504	rundll32.exe
1504	rundll32.exe
980	WerFault.exe
980	WerFault.exe
980	WerFault.exe
980	WerFault.exe
980	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	980	WerFault.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rundll32.exerundll32.exesvchost.exe

description	pid	process	target process
PID 776 wrote to memory of 1504	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 1504	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 1504	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 1504	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 1504	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 1504	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 1504	776	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 616	1504	rundll32.exe	svchost.exe
PID 1504 wrote to memory of 616	1504	rundll32.exe	svchost.exe
PID 1504 wrote to memory of 616	1504	rundll32.exe	svchost.exe
PID 1504 wrote to memory of 616	1504	rundll32.exe	svchost.exe
PID 1504 wrote to memory of 616	1504	rundll32.exe	svchost.exe
PID 1504 wrote to memory of 616	1504	rundll32.exe	svchost.exe
PID 616 wrote to memory of 980	616	svchost.exe	WerFault.exe
PID 616 wrote to memory of 980	616	svchost.exe	WerFault.exe
PID 616 wrote to memory of 980	616	svchost.exe	WerFault.exe
PID 616 wrote to memory of 980	616	svchost.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Hs52qascx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Hs52qascx.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 1044
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-7-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/616-8-0x0000000000401480-mapping.dmp

Download
memory/616-12-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/944-6-0x000007FEF74B0000-0x000007FEF772A000-memory.dmp

Filesize
2.5MB

Download
memory/980-10-0x0000000000000000-mapping.dmp

Download
memory/980-11-0x0000000001E70000-0x0000000001E81000-memory.dmp

Filesize
68KB

Download
memory/980-13-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1504-2-0x0000000000000000-mapping.dmp

Download
memory/1504-3-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1504-4-0x0000000074B00000-0x0000000074B0A000-memory.dmp

Filesize
40KB

Download
memory/1504-5-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing