hancitor | 5e7c3ce3fefe950f3a9a77cda46b63e68267783662b6434abf937200bba06fdb

Analysis

Target
hhh.mp3.dll
Size 726KB
Sample210914-tmd9jsbaal
SHA256 5e7c3ce3fefe950f3a9a77cda46b63e68267783662b6434abf937200bba06fdb
MD5 9bde38600642743a4f56c455490bbb03
SHA1 4ef76d149f01b46ac270ff54bdedc5b5614a0584
SHA512 7632753beae0f2dc3aa77be723b994bb936293564db1d27d53a1575d79fe0d3d69790beb9d556c2b54520a8bd9cdfa31d6507c75ec59491a291574155cf85214
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	4700	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 15 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4700	4684	rundll32.exe	69
PID 4684 wrote to memory of 4700	4684	rundll32.exe	69
PID 4684 wrote to memory of 4700	4684	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hhh.mp3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hhh.mp3.dll,#1
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4760

memory/4700-118-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Download

memory/4700-117-0x0000000000C40000-0x0000000000C48000-memory.dmp

Download