hancitor | a7170d048319be6f343f6378cd6ea83660bab8489cdbcda6b243b448c5e275ef

Analysis

Target
file.dll
Size 759KB
Sample210623-1n6334lar2
SHA256 a7170d048319be6f343f6378cd6ea83660bab8489cdbcda6b243b448c5e275ef
MD5 3a492d3738886c56aeea2fd6cc1fb178
SHA1 be69ff72eb730ac5dc66868777775b36b4821d1b
SHA512 e0168826e3ae85185706b8450f69738eb5bc8ae513480b6ed6cfabfeceefab66897bcfe0ee9256feb0e66b4dd463d9260665903ff96007042250d66778e8b1cc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	3772	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3772	3728	rundll32.exe	70
PID 3728 wrote to memory of 3772	3728	rundll32.exe	70
PID 3728 wrote to memory of 3772	3728	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 692
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2124

memory/3772-115-0x0000000002C40000-0x0000000002C63000-memory.dmp

Download

memory/3772-116-0x0000000002C40000-0x0000000002C63000-memory.dmp

Download