hancitor | ef37ce7eae391b7e1965d8c1da635bf5dec462ec5a192cf5971f7c1b547be6f1

Analysis

Target
ter.dll
Size 304KB
Sample210713-kpgm68t9sa
SHA256 ef37ce7eae391b7e1965d8c1da635bf5dec462ec5a192cf5971f7c1b547be6f1
MD5 e831863ca08c7cfef703e6ba85328c67
SHA1 6d075793fd766b7981974ed85fbade9ca63949e5
SHA512 e24602a44a5a7e262dcd76a9dd5bfbaf2d00fb8745e55f037ce8388d21b63c1878a93abe74d6b4acf0eabcd9d4b4938e0f16025b4a997d112a6f797e9ccdded2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	356	rundll32.exe
16	356	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
356	rundll32.exe
356	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 356	528	rundll32.exe	69
PID 528 wrote to memory of 356	528	rundll32.exe	69
PID 528 wrote to memory of 356	528	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ter.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:356

memory/356-115-0x0000000004D80000-0x0000000004E68000-memory.dmp

Download

memory/356-116-0x0000000004D80000-0x0000000004D8A000-memory.dmp

Download

memory/356-117-0x0000000004D81000-0x0000000004DB4000-memory.dmp

Download

memory/356-118-0x0000000003220000-0x000000000336A000-memory.dmp

Download