hancitor | 3efaec8a140db1bb2ca16483b7be9ff7cab4b10a7004e5dfecf3661380319363

Analysis

Target
ter.dll
Size 339KB
Sample210714-vsapvax8ys
SHA256 3efaec8a140db1bb2ca16483b7be9ff7cab4b10a7004e5dfecf3661380319363
MD5 7080fb5a647c157e18123d8589d014f4
SHA1 eb5060806368361a0c9c366b2fe1f06a52342c9e
SHA512 ee6823c58c2c642ac60f9152e8a7785cba9ecd16e3650284bad11072fdc050fbcedd0ff64534d0fb79ea25778d2c309a890d29c5185a63ec24730821087b6db7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 4 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 3808	772	rundll32.exe	59
PID 772 wrote to memory of 3808	772	rundll32.exe	59
PID 772 wrote to memory of 3808	772	rundll32.exe	59
PID 3808 wrote to memory of 1400	3808	rundll32.exe	80
PID 3808 wrote to memory of 1400	3808	rundll32.exe	80
PID 3808 wrote to memory of 1400	3808	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ter.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    PID:1400

memory/3808-115-0x0000000073AC0000-0x0000000073ACA000-memory.dmp

Download

memory/3808-116-0x0000000002760000-0x00000000028AA000-memory.dmp

Download