hancitor | a390e58d9cf6d18f69e625cc0a4dcb26c47923f0721cbcfe5f4f0e83df0aa686

Analysis

Target
yefff.dll
Size 348KB
Sample210903-ce6kdsbhe2
SHA256 a390e58d9cf6d18f69e625cc0a4dcb26c47923f0721cbcfe5f4f0e83df0aa686
MD5 3d62af3c204ccec789c3a079deba0b86
SHA1 80f30676d51de54b62ebe076e6718935f09dcd08
SHA512 cbbe7b32efcd4783992dbd9d986e24b03a95a6ffba1ef8fa650f2f5191be0f377bdf13e9c914d58633ba72a3dace5cf0d76b69221244c8d244adfaa059a76217
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 3 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 644	2840	rundll32.exe	70
PID 2840 wrote to memory of 644	2840	rundll32.exe	70
PID 2840 wrote to memory of 644	2840	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yefff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\yefff.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:644

memory/644-115-0x0000000073840000-0x000000007384A000-memory.dmp

Download

memory/644-116-0x0000000002990000-0x0000000002991000-memory.dmp

Download