hancitor | 2c19a75d22fd1a7d9b088407217f9b4534ba9c28253ac69b25f4408086285538

Analysis

Target

if.dll
Size

2.0MB
MD5

942a449dd39969b3a1c5e281b5ac8ec3
SHA1

98dd9ccf79d133c8f53ca72333a5ef95fcffaa24
SHA256

2c19a75d22fd1a7d9b088407217f9b4534ba9c28253ac69b25f4408086285538
SHA512

d7414404e165943c8c0298197f6401045b7ce3d31fcac5f195d75b44cb3348cc912b2c10ca9b2106e5ce88778694d4b9b70321348994fd19628486fd48946a60

Score

10^/10

Family

hancitor

Botnet

0112_dkwzmv

http://gincinen.com/9/forum.php

http://tposalons.ru/9/forum.php

http://sucvewdetw.ru/9/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 3 IoCs

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3996	2468	rundll32.exe	68
PID 2468 wrote to memory of 3996	2468	rundll32.exe	68
PID 2468 wrote to memory of 3996	2468	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3996

memory/3996-120-0x0000000010000000-0x0000000010210000-memory.dmp

Filesize
2.1MB

Download
memory/3996-119-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download