hancitor | 09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0

Analysis

Target

09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0.dll
Size

30KB
MD5

8c918dc7b09518710e4c8270e2f2778a
SHA1

6703c8e8f4e1a828d11f6899ed3dcaa149bd5172
SHA256

09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0
SHA512

ab46a739a18c471ad95bfe26c63c50d3f37766969d450d821cea83e5f0f3fb013a9291864bee86ed6aeb25a126dd59c099e81b4135c63c57b2bf7ee0010a0b23

Score

10^/10

Family

hancitor

Botnet

1812_78213

http://unceliet.com/4/forum.php

http://fitiondice.ru/4/forum.php

http://wordlegromin.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 936	1408	rundll32.exe	25

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
936	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1408	1396	rundll32.exe	20
PID 1396 wrote to memory of 1408	1396	rundll32.exe	20
PID 1396 wrote to memory of 1408	1396	rundll32.exe	20
PID 1396 wrote to memory of 1408	1396	rundll32.exe	20
PID 1396 wrote to memory of 1408	1396	rundll32.exe	20
PID 1396 wrote to memory of 1408	1396	rundll32.exe	20
PID 1396 wrote to memory of 1408	1396	rundll32.exe	20
PID 1408 wrote to memory of 936	1408	rundll32.exe	25
PID 1408 wrote to memory of 936	1408	rundll32.exe	25
PID 1408 wrote to memory of 936	1408	rundll32.exe	25
PID 1408 wrote to memory of 936	1408	rundll32.exe	25
PID 1408 wrote to memory of 936	1408	rundll32.exe	25
PID 1408 wrote to memory of 936	1408	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:936

memory/936-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1408-55-0x0000000075D21000-0x0000000075D23000-memory.dmp

Filesize
8KB

Download