Behavioral task
behavioral1
Sample
1a495667c6a44520eaa6f284a254973e0ea0cf222e37ab4bb06a9b5cf930d89c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1a495667c6a44520eaa6f284a254973e0ea0cf222e37ab4bb06a9b5cf930d89c.exe
Resource
win10v2004-20220414-en
General
-
Target
1a495667c6a44520eaa6f284a254973e0ea0cf222e37ab4bb06a9b5cf930d89c
-
Size
82KB
-
MD5
c33be1d9175fb390abc852669575ec31
-
SHA1
e079ff4d4b8f55dfd5660826335512e86bae857e
-
SHA256
1a495667c6a44520eaa6f284a254973e0ea0cf222e37ab4bb06a9b5cf930d89c
-
SHA512
e34256f4f23d9286f048e9cd1727f43ab7c56bcb55190b30d863bf3f868b000afcc0100f0af2632989fec35bef3b4f43c45acb983b4c91d94a56cc8d74715582
-
SSDEEP
768:n9NUY6kQ20YLiNqgM0C1GaOnUqHJpwlXoWRhuYMe7YmoGG6JizzoucYJ8F2/4:nv5GYLMMXejAMe7YmoGo4+OF2/
Malware Config
Extracted
hancitor
29tqn01
http://hedttoenhes.com/4/forum.php
http://peresnofe.ru/4/forum.php
http://motorsorlet.ru/4/forum.php
Signatures
-
Hancitor family
Files
-
1a495667c6a44520eaa6f284a254973e0ea0cf222e37ab4bb06a9b5cf930d89c.exe windows x86
8559cda00b61ee2180779641839dfc59
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDecrypt
CryptDestroyKey
CryptDeriveKey
CryptReleaseContext
CryptAcquireContextA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
iphlpapi
GetAdaptersAddresses
kernel32
GetComputerNameA
CreateFileA
GetTempFileNameA
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
GetVersion
lstrcpyA
lstrlenA
GetWindowsDirectoryA
GetVolumeInformationA
ExitProcess
Sleep
GetProcAddress
VirtualAlloc
VirtualFree
VirtualAllocEx
VirtualFreeEx
OpenProcess
TerminateProcess
CreateThread
GetProcessId
GetLastError
WriteProcessMemory
GetThreadContext
SetThreadContext
ResumeThread
WriteFile
CloseHandle
GetSystemInfo
lstrcmpiA
lstrcatA
LoadLibraryA
GetModuleHandleA
CreateProcessA
GetEnvironmentVariableA
GetTempPathA
psapi
GetProcessImageFileNameA
EnumProcesses
user32
wsprintfA
wininet
InternetOpenA
HttpSendRequestA
HttpQueryInfoA
InternetCrackUrlA
HttpOpenRequestA
InternetSetOptionA
InternetQueryOptionA
InternetReadFile
InternetConnectA
InternetCloseHandle
ntdll
RtlDecompressBuffer
Sections
.text Size: 55KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SCY Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE