hancitor | 5011dd0a26ca04555a12e570acb1143612ab95b975c42f21b2ae1b2bac0d213a

Analysis

Target
5011dd0a26ca04555a12e570acb1143612ab95b975c42f21b2ae1b2bac0d213a.dll
Size 194KB
Sample220524-cscjgafefl
SHA256 5011dd0a26ca04555a12e570acb1143612ab95b975c42f21b2ae1b2bac0d213a
MD5 4f9704564924daab2892d09c92bc0cf5
SHA1 3e5fdde184de1615d5e65cd52b97b114e2e21d20
SHA512 5005d33248e0ee31bf6d5a8661738a89d49f2b4b6d35dad5a6098a2bcb7a339ce61b823b3f1fffe856a20a3ccbd91d351cfed73c31639a544f2cd4592976a6fd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3744 set thread context of 400	3744	rundll32.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3188	3744	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3744	5040	rundll32.exe	75
PID 5040 wrote to memory of 3744	5040	rundll32.exe	75
PID 5040 wrote to memory of 3744	5040	rundll32.exe	75
PID 3744 wrote to memory of 400	3744	rundll32.exe	88
PID 3744 wrote to memory of 400	3744	rundll32.exe	88
PID 3744 wrote to memory of 400	3744	rundll32.exe	88
PID 3744 wrote to memory of 400	3744	rundll32.exe	88
PID 3744 wrote to memory of 400	3744	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5011dd0a26ca04555a12e570acb1143612ab95b975c42f21b2ae1b2bac0d213a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5011dd0a26ca04555a12e570acb1143612ab95b975c42f21b2ae1b2bac0d213a.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 652
    3⤵
    - Program crash
    PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3744 -ip 3744
1⤵
PID:1044

memory/400-132-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/400-136-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/400-137-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3744-134-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

Download

memory/3744-135-0x0000000010000000-0x0000000010035000-memory.dmp

Download