hancitor | 74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071

Analysis

Target
if.dll
Size 1.5MB
Sample220126-vxkprafgcq
SHA256 74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071
MD5 16b53cb2f51441477fea6ab45648adc5
SHA1 d7376a1c8eb7e690ead484b9d5177894315f238d
SHA512 af8f344131ba8706d0b77d6d93d00d3809277fc1691566d23101ce8269813d3945d1a65dd50795e74b4382e6b1f9be18d41d98515e2ead282a7a27c66911bb17
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4028	1356	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1356	3704	rundll32.exe	69
PID 3704 wrote to memory of 1356	3704	rundll32.exe	69
PID 3704 wrote to memory of 1356	3704	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#1
  2⤵
  PID:1356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 656
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4028

memory/1356-118-0x0000000004C00000-0x0000000004C07000-memory.dmp

Download

memory/1356-119-0x0000000004C20000-0x0000000004C28000-memory.dmp

Download