hancitor | 306d564fba556c9db12269b01bdadb3eba19e43c60f180c6f41a72a1fc9840d3

Analysis

Target
ter.dll
Size 654KB
Sample210804-clhctl3re2
SHA256 306d564fba556c9db12269b01bdadb3eba19e43c60f180c6f41a72a1fc9840d3
MD5 d7c87a735968d424d5c0aa2794d23657
SHA1 957a6ef9961e71d0207c5ab2ccc153b41f73e110
SHA512 5ef0e40f059cb752421af3123deef73df4544fe1653efdfdfa277ed879d06f6eb6d6ff5234ae159746f2dc9bbc167273851c1a14ace3f38bcd1661828b0e35d5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	1792	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1792	992	rundll32.exe	70
PID 992 wrote to memory of 1792	992	rundll32.exe	70
PID 992 wrote to memory of 1792	992	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ter.dll,#1
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 652
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:800

memory/1792-115-0x0000000000A60000-0x0000000000B07000-memory.dmp

Download

memory/1792-116-0x0000000000B70000-0x0000000000B78000-memory.dmp

Download

memory/1792-117-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Download