hancitor | fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b

Analysis

Target

fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b.dll
Size

153KB
MD5

bc6f26692a740920714e5ecd07858154
SHA1

53a64fd1e7b98666eb32983d48e3bb7efee189e7
SHA256

fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b
SHA512

60e798e00a3a30032967caa89254218d9a25d495596bbd5a6f4ef6165a8ebc81f1c76499e90591626c922e739df11d348a20db1ac79ec1e6bd75d194b59e84bf

Score

10^/10

Family

hancitor

Botnet

2201_8912354

http://hourtschem.com/4/forum.php

http://thicatlies.ru/4/forum.php

http://cousidrebn.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 996	1984	rundll32.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
996	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1984	2008	rundll32.exe	28
PID 2008 wrote to memory of 1984	2008	rundll32.exe	28
PID 2008 wrote to memory of 1984	2008	rundll32.exe	28
PID 2008 wrote to memory of 1984	2008	rundll32.exe	28
PID 2008 wrote to memory of 1984	2008	rundll32.exe	28
PID 2008 wrote to memory of 1984	2008	rundll32.exe	28
PID 2008 wrote to memory of 1984	2008	rundll32.exe	28
PID 1984 wrote to memory of 996	1984	rundll32.exe	29
PID 1984 wrote to memory of 996	1984	rundll32.exe	29
PID 1984 wrote to memory of 996	1984	rundll32.exe	29
PID 1984 wrote to memory of 996	1984	rundll32.exe	29
PID 1984 wrote to memory of 996	1984	rundll32.exe	29
PID 1984 wrote to memory of 996	1984	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:996

memory/996-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/996-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/996-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/996-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/996-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1984-57-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1984-64-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1984-63-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1984-58-0x00000000001A0000-0x00000000001A9000-memory.dmp

Filesize
36KB

Download
memory/1984-56-0x00000000001A0000-0x00000000001A9000-memory.dmp

Filesize
36KB

Download
memory/1984-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download