hancitor | 12f87dd075fc12c2b6b15a1eb5ca209ba056bb6aa2feaf3518163192a17a7a3b

Analysis

Target

12f87dd075fc12c2b6b15a1eb5ca209ba056bb6aa2feaf3518163192a17a7a3b.dll
Size

280KB
MD5

18ed9dca690e7588a6f12f2eeab3921a
SHA1

2151775b62efb39e75ee1ad883c47c60d4b3c145
SHA256

12f87dd075fc12c2b6b15a1eb5ca209ba056bb6aa2feaf3518163192a17a7a3b
SHA512

1c828f67ffa0c292990769ed167d8988e1708ce429e54939a0d6506a646cb16b82e7ee77678ccb64cba1c1f918203fd3643c9f8b8c1fe98c58a14e7b7203e5af

Score

10^/10

Family

hancitor

Botnet

1203_4893743248

http://bralibuda.com/4/forum.php

http://greferezud.com/4/forum.php

http://deraelous.com/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 1416	1656	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1416	svchost.exe
1416	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1656	1636	rundll32.exe	27
PID 1636 wrote to memory of 1656	1636	rundll32.exe	27
PID 1636 wrote to memory of 1656	1636	rundll32.exe	27
PID 1636 wrote to memory of 1656	1636	rundll32.exe	27
PID 1636 wrote to memory of 1656	1636	rundll32.exe	27
PID 1636 wrote to memory of 1656	1636	rundll32.exe	27
PID 1636 wrote to memory of 1656	1636	rundll32.exe	27
PID 1656 wrote to memory of 1416	1656	rundll32.exe	28
PID 1656 wrote to memory of 1416	1656	rundll32.exe	28
PID 1656 wrote to memory of 1416	1656	rundll32.exe	28
PID 1656 wrote to memory of 1416	1656	rundll32.exe	28
PID 1656 wrote to memory of 1416	1656	rundll32.exe	28
PID 1656 wrote to memory of 1416	1656	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12f87dd075fc12c2b6b15a1eb5ca209ba056bb6aa2feaf3518163192a17a7a3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12f87dd075fc12c2b6b15a1eb5ca209ba056bb6aa2feaf3518163192a17a7a3b.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1416

memory/1416-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1416-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1416-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1656-56-0x0000000000160000-0x0000000000169000-memory.dmp

Filesize
36KB

Download
memory/1656-57-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download