Analysis
-
max time kernel
128s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28/05/2022, 06:18
General
-
Target
02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe
-
Size
249KB
-
MD5
a0d23bbe7cb0a091a308018a22402154
-
SHA1
48df1bca038752508402b42cf802af43a044d008
-
SHA256
02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed
-
SHA512
deca2b3185d5f39cbaee0428fca55acf8e0c1ef73d9137ae76077259546c56d07d111e481cfcbf743783f276b3bcf9ce63149bd36c8791c5eae01265af1350b5
Score
10/10
Malware Config
Extracted
Family
hancitor
Botnet
2205_674384
C2
http://kingusaref.com/4/forum.php
http://retnejustren.ru/4/forum.php
http://tansinmaked.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe"C:\Users\Admin\AppData\Local\Temp\02258bfbe7dd5966e0fcc342277f0ce537444c62aeed9adb1b913c48b6c7f2ed.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
560KB
-
Filesize
28KB
-
Filesize
560KB