hancitor | 14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec

Analysis

Target
14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll
Size 32KB
Sample220609-k2mpssecck
SHA256 14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec
MD5 3269403f22012392c84afd2893d9b2c3
SHA1 dbbaa659b2df403dd029555f9cfbac1dad255723
SHA512 6a0981a9565d2e1a9ad6cc126f0e29557f2a2ee8cf48a079ab24dc38c94553f2e90851d5043cc2a9da6a6d4153327efba2a3c22552bd095521be6d7a2f66c60f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4504 set thread context of 1484	4504	rundll32.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4504	2784	rundll32.exe	79
PID 2784 wrote to memory of 4504	2784	rundll32.exe	79
PID 2784 wrote to memory of 4504	2784	rundll32.exe	79
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80
PID 4504 wrote to memory of 1484	4504	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14edb72021fa36f77ef8b477af70ef25bfd1dfa72331fb2f48ab09a8817f9cec.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1484

memory/1484-132-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1484-134-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1484-135-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1484-136-0x0000000000400000-0x0000000000409000-memory.dmp

Download