hancitor | bc1456429475460bff1d0ec8eeb34d0a54a8fe2dcd08d12d3e7299dfc07bbd91

Analysis

Target
file.dll
Size 759KB
Sample210623-dpwfpflt1e
SHA256 bc1456429475460bff1d0ec8eeb34d0a54a8fe2dcd08d12d3e7299dfc07bbd91
MD5 b42bc6ed08b75131eb5043a84235202c
SHA1 4eb0c4573d81b47275524da3b1505fdc57ab0d0f
SHA512 a1904ee65a7f95eba8c44a70e2eee363b9969d163a391dc9fd5d6e789d7794b109ee4f3d158ffe7a463677d9ec168adc6b6b7c1704a6433bb0052915b7cc32b5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	3432	WerFault.exe	51

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3432	4016	rundll32.exe	51
PID 4016 wrote to memory of 3432	4016	rundll32.exe	51
PID 4016 wrote to memory of 3432	4016	rundll32.exe	51

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 676
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2464

memory/3432-115-0x0000000000D50000-0x0000000000D58000-memory.dmp

Download

memory/3432-116-0x0000000002DD0000-0x0000000002DDA000-memory.dmp

Download