hancitor | 17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963

Analysis

Target

17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963.dll
Size

147KB
MD5

807270038736d7095ef4c134afac8054
SHA1

56df9dca3588f02d6d44946651bf134116e50e14
SHA256

17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963
SHA512

3f9e21b7076eff56735d784ddb5902274bfc6bc899a43a13ba8510e1ed00daa87ee1f867bea488f637601a829d4c424dccd039e07160014230b859731db182d7

Score

10^/10

Family

hancitor

Botnet

2410_43984389

http://wickawbarrysci.com/4/forum.php

http://scangescangomu.ru/4/forum.php

http://penreleaplif.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2544 set thread context of 912	2544	rundll32.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
912	svchost.exe
912	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2544	4524	rundll32.exe	78
PID 4524 wrote to memory of 2544	4524	rundll32.exe	78
PID 4524 wrote to memory of 2544	4524	rundll32.exe	78
PID 2544 wrote to memory of 912	2544	rundll32.exe	79
PID 2544 wrote to memory of 912	2544	rundll32.exe	79
PID 2544 wrote to memory of 912	2544	rundll32.exe	79
PID 2544 wrote to memory of 912	2544	rundll32.exe	79
PID 2544 wrote to memory of 912	2544	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17454b5c4de7f3404668c1bf54a691c577b9c26adf5987b7c6fa748fc1267963.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:912

memory/912-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/912-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/912-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2544-131-0x0000000001460000-0x0000000001469000-memory.dmp

Filesize
36KB

Download
memory/2544-137-0x0000000001490000-0x000000000149C000-memory.dmp

Filesize
48KB

Download
memory/2544-136-0x0000000001460000-0x0000000001469000-memory.dmp

Filesize
36KB

Download