hancitor | efbdd00df327459c9db2ffc79b2408f7f3c60e8ba5f8c5ffd0debaff986863a8

Analysis

Target
jjy.dll
Size 400KB
Sample210826-wr4bdhph52
SHA256 efbdd00df327459c9db2ffc79b2408f7f3c60e8ba5f8c5ffd0debaff986863a8
MD5 2172fdc8532872295d309682c5f323d9
SHA1 a539b7fcb7706ade3f5a3e9b01c27ae2399fbe61
SHA512 7aa5c086f027fe6a2507389b9b3f0390649e8ab4f3080c89827dfcbfbf3ede5d9df5f9b385a3596f1b7bb0a9d80b330edee7a9b88c868090f7d9ce151e862191
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 3 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1524	900	rundll32.exe	70
PID 900 wrote to memory of 1524	900	rundll32.exe	70
PID 900 wrote to memory of 1524	900	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jjy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jjy.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

memory/1524-115-0x0000000010000000-0x000000001000A000-memory.dmp

Download

memory/1524-116-0x0000000004770000-0x0000000004771000-memory.dmp

Download