hancitor | 74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071

Analysis

max time kernel
97s
max time network
138s
platform
windows10_x64
resource
win10-en-20211208
submitted
26-01-2022 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

if.dll
Size

1.5MB
MD5

16b53cb2f51441477fea6ab45648adc5
SHA1

d7376a1c8eb7e690ead484b9d5177894315f238d
SHA256

74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071
SHA512

af8f344131ba8706d0b77d6d93d00d3809277fc1691566d23101ce8269813d3945d1a65dd50795e74b4382e6b1f9be18d41d98515e2ead282a7a27c66911bb17

Score

10^/10

hancitor 2401_hjksd downloader

Malware Config

Extracted

Family

hancitor

Botnet

2401_hjksd

http://fountandevin.com/9/forum.php

http://nummasdocarm.ru/9/forum.php

http://beetwedwornew.ru/9/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4028 1356 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4028	1356	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4028 WerFault.exe
Token: SeBackupPrivilege 4028 WerFault.exe
Token: SeDebugPrivilege 4028 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	4028	WerFault.exe
Token: SeBackupPrivilege	4028	WerFault.exe
Token: SeDebugPrivilege	4028	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3704 wrote to memory of 1356	3704	rundll32.exe	rundll32.exe
PID 3704 wrote to memory of 1356	3704	rundll32.exe	rundll32.exe
PID 3704 wrote to memory of 1356	3704	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#1
2⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 656
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-118-0x0000000004C00000-0x0000000004C07000-memory.dmp

Filesize
28KB

Download
memory/1356-119-0x0000000004C20000-0x0000000004C28000-memory.dmp

Filesize
32KB

Download