hancitor | 14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec

Analysis

Target

14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll
Size

32KB
MD5

3269403f22012392c84afd2893d9b2c3
SHA1

dbbaa659b2df403dd029555f9cfbac1dad255723
SHA256

14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec
SHA512

6a0981a9565d2e1a9ad6cc126f0e29557f2a2ee8cf48a079ab24dc38c94553f2e90851d5043cc2a9da6a6d4153327efba2a3c22552bd095521be6d7a2f66c60f

Score

10^/10

Family

hancitor

Botnet

0912_1237732

http://featicent.com/4/forum.php

http://whysturprom.ru/4/forum.php

http://usseleteria.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 904 set thread context of 624	904	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

svchost.exe

pid	Process
624	svchost.exe
624	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1320 wrote to memory of 904	1320	rundll32.exe	27
PID 1320 wrote to memory of 904	1320	rundll32.exe	27
PID 1320 wrote to memory of 904	1320	rundll32.exe	27
PID 1320 wrote to memory of 904	1320	rundll32.exe	27
PID 1320 wrote to memory of 904	1320	rundll32.exe	27
PID 1320 wrote to memory of 904	1320	rundll32.exe	27
PID 1320 wrote to memory of 904	1320	rundll32.exe	27
PID 904 wrote to memory of 624	904	rundll32.exe	28
PID 904 wrote to memory of 624	904	rundll32.exe	28
PID 904 wrote to memory of 624	904	rundll32.exe	28
PID 904 wrote to memory of 624	904	rundll32.exe	28
PID 904 wrote to memory of 624	904	rundll32.exe	28
PID 904 wrote to memory of 624	904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:624

memory/624-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/624-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/624-59-0x0000000000402960-mapping.dmp

Download
memory/624-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/624-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/624-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/904-54-0x0000000000000000-mapping.dmp

Download
memory/904-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Filesize
8KB

Download