Analysis
- max time kernel
130s - max time network
134s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
31/01/2022, 15:55
General
- Target if.dll
- Size 1.5MB
- Sample220131-tcsn7ahgal
- SHA256 ebe7a2c72e2e89732d435a7d491c9cd85f125b1584bb807f921b03dff9d16b94
Score
10/10
Malware Config
Extracted
Family
-
hancitor
Botnet
-
3101_sjiuwe
C2
-
http://cinenmera.com/9/forum.php
-
http://biquagin.ru/9/forum.php
-
http://joirwsin.ru/9/forum.php
Signatures
- Hancitor
Hancitor is downloader used to deliver other malware families.
- Blocklisted process makes network request 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\if.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1292-54-0x0000000076641000-0x0000000076643000-memory.dmp
memory/1292-55-0x0000000001EB0000-0x0000000002034000-memory.dmp
memory/1292-56-0x00000000001F0000-0x00000000001F8000-memory.dmp
memory/1292-57-0x00000000001F0000-0x00000000001F8000-memory.dmp
memory/1292-58-0x00000000001D0000-0x00000000001D7000-memory.dmp