hancitor | 5c02107df5183c09261e0ce58e2ad73e68442bc3280924eb2786384a1429a007

General

Target

5c02107df5183c09261e0ce58e2ad73e68442bc3280924eb2786384a1429a007.dll
Size

396KB
MD5

a719b7f1fb27224ae86ddaffe28604cc
SHA1

03cc556ac4180bcddf189d189f2455d6b66cafee
SHA256

5c02107df5183c09261e0ce58e2ad73e68442bc3280924eb2786384a1429a007
SHA512

51f1a45fdf262f1d43bd8329eeea658c0fd04c57ac13d9448291d0b3198d4f226b1d00b2431b2f717c53609abe62bcd4679ca295951bbc93da9b3b1429ec78d9

Score

10^/10

hancitor 0312_89324 downloader

Malware Config

Extracted

Family

hancitor

Botnet

0312_89324

C2

http://bandieve.com/8/forum.php

http://decturnearrips.ru/8/forum.php

http://looduchavens.ru/8/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1188	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1188	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1188	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1188	1680	rundll32.exe	27
PID 1680 wrote to memory of 1188	1680	rundll32.exe	27
PID 1680 wrote to memory of 1188	1680	rundll32.exe	27
PID 1680 wrote to memory of 1188	1680	rundll32.exe	27
PID 1680 wrote to memory of 1188	1680	rundll32.exe	27
PID 1680 wrote to memory of 1188	1680	rundll32.exe	27
PID 1680 wrote to memory of 1188	1680	rundll32.exe	27
PID 1188 wrote to memory of 2004	1188	rundll32.exe	30
PID 1188 wrote to memory of 2004	1188	rundll32.exe	30
PID 1188 wrote to memory of 2004	1188	rundll32.exe	30
PID 1188 wrote to memory of 2004	1188	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c02107df5183c09261e0ce58e2ad73e68442bc3280924eb2786384a1429a007.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c02107df5183c09261e0ce58e2ad73e68442bc3280924eb2786384a1429a007.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 820
    3⤵
    - Program crash
    PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1188-55-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-56-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-57-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/1188-58-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-59-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-60-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-61-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-62-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-63-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-64-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-65-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-66-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-67-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-68-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-69-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-70-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1188-71-0x0000000000A10000-0x0000000000A45000-memory.dmp

Filesize
212KB

Download
memory/1188-72-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing