hancitor | 8efac1531e83525bb0806eebca0bb9a797a18feb1848a4ceee4a88fdb85cbbbd

Analysis

Target

532.dll
Size

200KB
MD5

7348620f737ec1b0997cae7548344f2c
SHA1

5550f62fdc0963c331b460f8a967c45d481e505a
SHA256

8efac1531e83525bb0806eebca0bb9a797a18feb1848a4ceee4a88fdb85cbbbd
SHA512

568babf18ba8ad33c9756e43610172361132f076bb4601e0e046317a30a298da453219f43a2b5ffafc5c535e4ca62ffff622ae7bf084efba786946b880f9ddb6

Score

10^/10

Family

hancitor

Botnet

2207_xwpi67

http://tholeferli.com/8/forum.php

http://aidgodown.ru/8/forum.php

http://relifleappin.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

16 1300 rundll32.exe
18 1300 rundll32.exe
20 1300 rundll32.exe
21 1300 rundll32.exe
Downloads MZ/PE file
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1300 rundll32.exe
1300 rundll32.exe
1300 rundll32.exe
1300 rundll32.exe

flow	ioc
15	api.ipify.org

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 656 wrote to memory of 1300	656	rundll32.exe	rundll32.exe
PID 656 wrote to memory of 1300	656	rundll32.exe	rundll32.exe
PID 656 wrote to memory of 1300	656	rundll32.exe	rundll32.exe
PID 1300 wrote to memory of 1504	1300	rundll32.exe	svchost.exe
PID 1300 wrote to memory of 1504	1300	rundll32.exe	svchost.exe
PID 1300 wrote to memory of 1504	1300	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\532.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656

memory/1300-114-0x0000000000000000-mapping.dmp

Download
memory/1300-115-0x00000000010A0000-0x0000000001166000-memory.dmp

Filesize
792KB

Download
memory/1300-116-0x00000000010A0000-0x00000000010AA000-memory.dmp

Filesize
40KB

Download
memory/1300-117-0x00000000010A1000-0x00000000010B9000-memory.dmp

Filesize
96KB

Download
memory/1300-118-0x0000000000AF0000-0x0000000000C3A000-memory.dmp

Filesize
1.3MB

Download