hancitor | 17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963

Analysis

Target

17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963.dll
Size

147KB
MD5

807270038736d7095ef4c134afac8054
SHA1

56df9dca3588f02d6d44946651bf134116e50e14
SHA256

17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963
SHA512

3f9e21b7076eff56735d784ddb5902274bfc6bc899a43a13ba8510e1ed00daa87ee1f867bea488f637601a829d4c424dccd039e07160014230b859731db182d7

Score

10^/10

Family

hancitor

Botnet

2410_43984389

http://wickawbarrysci.com/4/forum.php

http://scangescangomu.ru/4/forum.php

http://penreleaplif.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 1656	1664	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	svchost.exe
1656	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1664	1260	rundll32.exe	27
PID 1260 wrote to memory of 1664	1260	rundll32.exe	27
PID 1260 wrote to memory of 1664	1260	rundll32.exe	27
PID 1260 wrote to memory of 1664	1260	rundll32.exe	27
PID 1260 wrote to memory of 1664	1260	rundll32.exe	27
PID 1260 wrote to memory of 1664	1260	rundll32.exe	27
PID 1260 wrote to memory of 1664	1260	rundll32.exe	27
PID 1664 wrote to memory of 1656	1664	rundll32.exe	28
PID 1664 wrote to memory of 1656	1664	rundll32.exe	28
PID 1664 wrote to memory of 1656	1664	rundll32.exe	28
PID 1664 wrote to memory of 1656	1664	rundll32.exe	28
PID 1664 wrote to memory of 1656	1664	rundll32.exe	28
PID 1664 wrote to memory of 1656	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1656

memory/1656-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1664-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/1664-61-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/1664-63-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/1664-65-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download