hancitor | d83fbc9534957dd464cbc7cd2797d3041bd0d1a72b213b1ab7bccaec34359dbb

Analysis

Target

gelfor.dap.dll
Size

696KB
MD5

522d9c5981133e496fb4d21ee2dc54a2
SHA1

2c0f7b0ba7c561cd65f02872fcaacef14663923b
SHA256

d83fbc9534957dd464cbc7cd2797d3041bd0d1a72b213b1ab7bccaec34359dbb
SHA512

10d336a68bafb412970318ed64fbba1c4387c0db34462eeb580d737877174d7afcd160c7017e8bae6db103bb88f370c18af95c457d286ab89ef55e2ab2a7dd15

Score

10^/10

Family

hancitor

Botnet

0211_ponxwe

http://mettlybothe.com/8/forum.php

http://herstrairzoj.ru/8/forum.php

http://allonsetkes.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 3 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
608	rundll32.exe
608	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 608	1624	rundll32.exe	27
PID 1624 wrote to memory of 608	1624	rundll32.exe	27
PID 1624 wrote to memory of 608	1624	rundll32.exe	27
PID 1624 wrote to memory of 608	1624	rundll32.exe	27
PID 1624 wrote to memory of 608	1624	rundll32.exe	27
PID 1624 wrote to memory of 608	1624	rundll32.exe	27
PID 1624 wrote to memory of 608	1624	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gelfor.dap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gelfor.dap.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:608

memory/608-56-0x0000000074F61000-0x0000000074F63000-memory.dmp

Filesize
8KB

Download
memory/608-57-0x0000000000330000-0x00000000003E2000-memory.dmp

Filesize
712KB

Download
memory/608-58-0x00000000001C0000-0x00000000001C7000-memory.dmp

Filesize
28KB

Download
memory/608-60-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/608-61-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download