hancitor | 571cba0431acea4739c5248de1b1d33e76e995b3c7454f4d88d2785ade6fdf74

Analysis

Target

iff.bin.dll
Size

621KB
MD5

9f09b1dd6235c28b091a7dbc9bcd9482
SHA1

b7ac19b82e2f946e7cc047421875bbade3e880fd
SHA256

571cba0431acea4739c5248de1b1d33e76e995b3c7454f4d88d2785ade6fdf74
SHA512

19035aef95de7160c7584dd0f309ecfa05c428c9b4c4fd194f587e2cb0845717678121753a7f55c903907086b06f5d3b92693557448334d73457ab321c4d6750

Score

10^/10

Family

hancitor

Botnet

1612_mcxplkjg

http://hiltustra.com/9/forum.php

http://corelince.ru/9/forum.php

http://mernwel.ru/9/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	1476	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1668	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1476	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1476	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1476	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1476	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1476	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1476	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1476	1448	regsvr32.exe	27
PID 1476 wrote to memory of 1668	1476	regsvr32.exe	28
PID 1476 wrote to memory of 1668	1476	regsvr32.exe	28
PID 1476 wrote to memory of 1668	1476	regsvr32.exe	28
PID 1476 wrote to memory of 1668	1476	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\iff.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\iff.bin.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 328
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1668

memory/1448-55-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Filesize
8KB

Download
memory/1476-57-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/1476-59-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1476-60-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/1668-61-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download