hancitor | 8efac1531e83525bb0806eebca0bb9a797a18feb1848a4ceee4a88fdb85cbbbd

Analysis

Target
532.dll
Size 200KB
Sample210722-4a7m1txc46
SHA256 8efac1531e83525bb0806eebca0bb9a797a18feb1848a4ceee4a88fdb85cbbbd
MD5 7348620f737ec1b0997cae7548344f2c
SHA1 5550f62fdc0963c331b460f8a967c45d481e505a
SHA512 568babf18ba8ad33c9756e43610172361132f076bb4601e0e046317a30a298da453219f43a2b5ffafc5c535e4ca62ffff622ae7bf084efba786946b880f9ddb6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 4 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1300	656	rundll32.exe	70
PID 656 wrote to memory of 1300	656	rundll32.exe	70
PID 656 wrote to memory of 1300	656	rundll32.exe	70
PID 1300 wrote to memory of 1504	1300	rundll32.exe	79
PID 1300 wrote to memory of 1504	1300	rundll32.exe	79
PID 1300 wrote to memory of 1504	1300	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\532.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\532.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    PID:1504

memory/1300-115-0x00000000010A0000-0x0000000001166000-memory.dmp

Download

memory/1300-116-0x00000000010A0000-0x00000000010AA000-memory.dmp

Download

memory/1300-117-0x00000000010A1000-0x00000000010B9000-memory.dmp

Download

memory/1300-118-0x0000000000AF0000-0x0000000000C3A000-memory.dmp

Download