Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
28-05-2022 06:18
Static task
static1
Behavioral task
behavioral1
Sample
02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe
Resource
win10v2004-20220414-en
General
-
Target
02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe
-
Size
249KB
-
MD5
a0d23bbe7cb0a091a308018a22402154
-
SHA1
48df1bca038752508402b42cf802af43a044d008
-
SHA256
02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed
-
SHA512
deca2b3185d5f39cbaee0428fca55acf8e0c1ef73d9137ae76077259546c56d07d111e481cfcbf743783f276b3bcf9ce63149bd36c8791c5eae01265af1350b5
Malware Config
Extracted
hancitor
2205_674384
http://kingusaref.com/4/forum.php
http://retnejustren.ru/4/forum.php
http://tansinmaked.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exepid process 2004 02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe 2004 02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2004-54-0x0000000000583000-0x000000000058A000-memory.dmpFilesize
28KB
-
memory/2004-55-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB
-
memory/2004-56-0x0000000000583000-0x000000000058A000-memory.dmpFilesize
28KB
-
memory/2004-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2004-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB