hancitor | 4b89b68ee6d537954ea5987106f6416665bb5dc641b14861b00414e67732588f

General

Target

Static.dll
Size

351KB
MD5

f83f57a080a7ae18947658684d275eb2
SHA1

a61d01fb106540fabe402e0cf462b8fb52f3a2fa
SHA256

4b89b68ee6d537954ea5987106f6416665bb5dc641b14861b00414e67732588f
SHA512

83dacd4d8ca99fdbf547db3c49ffbe8f30563730f72af3c2d32e1599ea68a5b617fff518c4d45c99ecf0c704f4e43ee6d7d6a5b796d879aab4850b8b408e009e

Score

10^/10

hancitor 2502_ser3402 downloader

Malware Config

Extracted

Family

hancitor

Botnet

2502_ser3402

C2

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 17 IoCs

Processes:

rundll32.exe

flow	pid	process
6	1932	rundll32.exe
9	1932	rundll32.exe
11	1932	rundll32.exe
22	1932	rundll32.exe
30	1932	rundll32.exe
36	1932	rundll32.exe
43	1932	rundll32.exe
49	1932	rundll32.exe
57	1932	rundll32.exe
63	1932	rundll32.exe
69	1932	rundll32.exe
76	1932	rundll32.exe
82	1932	rundll32.exe
89	1932	rundll32.exe
96	1932	rundll32.exe
102	1932	rundll32.exe
109	1932	rundll32.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
13 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1932 set thread context of 1156 1932 rundll32.exe svchost.exe

flow	ioc
5	api.ipify.org
13	api.ipify.org

description	pid	process	target process
PID 1932 set thread context of 1156	1932	rundll32.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

rundll32.exe

pid	process
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 292 wrote to memory of 1932	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 1932	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 1932	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 1932	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 1932	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 1932	292	rundll32.exe	rundll32.exe
PID 292 wrote to memory of 1932	292	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 1156	1932	rundll32.exe	svchost.exe
PID 1932 wrote to memory of 1156	1932	rundll32.exe	svchost.exe
PID 1932 wrote to memory of 1156	1932	rundll32.exe	svchost.exe
PID 1932 wrote to memory of 1156	1932	rundll32.exe	svchost.exe
PID 1932 wrote to memory of 1156	1932	rundll32.exe	svchost.exe
PID 1932 wrote to memory of 1156	1932	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Static.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Static.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
PID:1156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-6-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Filesize
2.5MB

Download
memory/1156-7-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1156-8-0x0000000000401480-mapping.dmp

Download
memory/1156-10-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1932-2-0x0000000000000000-mapping.dmp

Download
memory/1932-3-0x0000000076861000-0x0000000076863000-memory.dmp

Filesize
8KB

Download
memory/1932-4-0x0000000075480000-0x000000007548A000-memory.dmp

Filesize
40KB

Download
memory/1932-5-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads