hancitor | c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9

Analysis

Target

c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9.dll
Size

153KB
MD5

bcb2cb4b1013272f4ffd5b4a572d1ba4
SHA1

10088466c6a991a67a71392ec93d3cdfc6e5864f
SHA256

c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9
SHA512

e114319901c27d7587e68ca44d5cda9f12ce59b719ad080811ac07de765325c692edd341cea6dd9f75ba80de620e0ce9a2fbc61c060f45ee1a8af3f32936a0e8

Score

10^/10

Family

hancitor

Botnet

2301_983487

http://tariroalz.com/4/forum.php

http://rindicatle.ru/4/forum.php

http://torssestih.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 1140	1096	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1140	svchost.exe
1140	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 1096	732	rundll32.exe	27
PID 732 wrote to memory of 1096	732	rundll32.exe	27
PID 732 wrote to memory of 1096	732	rundll32.exe	27
PID 732 wrote to memory of 1096	732	rundll32.exe	27
PID 732 wrote to memory of 1096	732	rundll32.exe	27
PID 732 wrote to memory of 1096	732	rundll32.exe	27
PID 732 wrote to memory of 1096	732	rundll32.exe	27
PID 1096 wrote to memory of 1140	1096	rundll32.exe	28
PID 1096 wrote to memory of 1140	1096	rundll32.exe	28
PID 1096 wrote to memory of 1140	1096	rundll32.exe	28
PID 1096 wrote to memory of 1140	1096	rundll32.exe	28
PID 1096 wrote to memory of 1140	1096	rundll32.exe	28
PID 1096 wrote to memory of 1140	1096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3ca95d1ffbcc03b2759edd3d14705f56e32f0bd88e051686ee1e78ae03ec0b9.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1140

memory/1096-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1096-56-0x0000000000160000-0x0000000000169000-memory.dmp

Filesize
36KB

Download
memory/1096-61-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/1096-63-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/1096-64-0x0000000000160000-0x0000000000169000-memory.dmp

Filesize
36KB

Download
memory/1140-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1140-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1140-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1140-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1140-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download