hancitor | 4f3b09dbaad57abf96b62397aff69a42583a1298a0b3f2488453dca20189a9a8

Analysis

Target
jjy.bin.dll
Size 800KB
Sample210818-q83xt4sg76
SHA256 bb3cfed0b433c158af3238573507836cd6c42a40240852a0ae22bcfd48038b8c
MD5 7d947a3d37f370b12fec5f1df82dfd1e
SHA1 e5999fccef4769c0c7ae66b9ec6eaaf7c3326c46
SHA512 9bf47cbfa989cbd55e48675b83799559cc7ffa40023520dfe072d4889872abe341d099e9915d96b7c5ef0aea05e554ec58dd0f91e3b0324f53d922dbd09b675f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	4568	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4568	4464	rundll32.exe	73
PID 4464 wrote to memory of 4568	4464	rundll32.exe	73
PID 4464 wrote to memory of 4568	4464	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jjy.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jjy.bin.dll,#1
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 676
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5100

memory/4568-116-0x0000000004C50000-0x0000000004C5A000-memory.dmp

Download

memory/4568-115-0x0000000003280000-0x00000000032A3000-memory.dmp

Download