hancitor | 14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec

Analysis

Target

14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll
Size

32KB
MD5

3269403f22012392c84afd2893d9b2c3
SHA1

dbbaa659b2df403dd029555f9cfbac1dad255723
SHA256

14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec
SHA512

6a0981a9565d2e1a9ad6cc126f0e29557f2a2ee8cf48a079ab24dc38c94553f2e90851d5043cc2a9da6a6d4153327efba2a3c22552bd095521be6d7a2f66c60f

Score

10^/10

Family

hancitor

Botnet

0912_1237732

http://featicent.com/4/forum.php

http://whysturprom.ru/4/forum.php

http://usseleteria.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4504 set thread context of 1484	4504	rundll32.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 2784 wrote to memory of 4504	2784	rundll32.exe	79
PID 2784 wrote to memory of 4504	2784	rundll32.exe	79
PID 2784 wrote to memory of 4504	2784	rundll32.exe	79
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1484

memory/1484-131-0x0000000000000000-mapping.dmp

Download
memory/1484-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1484-134-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1484-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1484-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4504-130-0x0000000000000000-mapping.dmp

Download