hancitor | 74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071

Analysis

Target

if.dll
Size

1.5MB
MD5

16b53cb2f51441477fea6ab45648adc5
SHA1

d7376a1c8eb7e690ead484b9d5177894315f238d
SHA256

74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071
SHA512

af8f344131ba8706d0b77d6d93d00d3809277fc1691566d23101ce8269813d3945d1a65dd50795e74b4382e6b1f9be18d41d98515e2ead282a7a27c66911bb17

Score

10^/10

Family

hancitor

Botnet

2401_hjksd

http://fountandevin.com/9/forum.php

http://nummasdocarm.ru/9/forum.php

http://beetwedwornew.ru/9/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

5 1680 rundll32.exe
7 1680 rundll32.exe
8 1680 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1680 rundll32.exe
1680 rundll32.exe

flow	ioc
4	api.ipify.org

pid	process
1680	rundll32.exe
1680	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1520 wrote to memory of 1680	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1680	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1680	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1680	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1680	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1680	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1680	1520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

memory/1680-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1680-55-0x0000000001F00000-0x000000000207E000-memory.dmp

Filesize
1.5MB

Download
memory/1680-56-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/1680-57-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/1680-58-0x0000000000150000-0x0000000000157000-memory.dmp

Filesize
28KB

Download