hancitor | d6c7b5f170665c8efc084b4f841ea26c4bfa6f7ed9ed6cbc6712c0a0788ae3cb

Analysis

Target
triage_dropped_file.dll
Size 291KB
Sample210707-vc64ctfv2n
SHA256 d6c7b5f170665c8efc084b4f841ea26c4bfa6f7ed9ed6cbc6712c0a0788ae3cb
MD5 0596744a0d841da80190069d626eb899
SHA1 2e1d746e7ea15e94b3a22c66cf1c40d8f0a931fa
SHA512 c97c4491d615b868c9eb94b4703ee52ada1e0f31d3cad357b217287a0c716125a5c246edf5182189514062d8e0228b421afdc13df462fb64676a355b7ba360af
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 3 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	rundll32.exe
1228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 1228	808	rundll32.exe	69
PID 808 wrote to memory of 1228	808	rundll32.exe	69
PID 808 wrote to memory of 1228	808	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

memory/1228-115-0x0000000073CD0000-0x0000000073CDA000-memory.dmp

Download

memory/1228-116-0x00000000006E0000-0x000000000082A000-memory.dmp

Download