hancitor | 3f1be0bf22eb9c01ecfd1a9d8a9fbe46ce103567a3876d9c28ab8b2b21feddfc

General

Target

3f1be0bf22eb9c01ecfd1a9d8a9fbe46ce103567a3876d9c28ab8b2b21feddfc.dll
Size

146KB
MD5

e74c3bdd43f79a329239e9680336dafb
SHA1

8eef521c52eb819c066ae097f33ebd0dee43114a
SHA256

3f1be0bf22eb9c01ecfd1a9d8a9fbe46ce103567a3876d9c28ab8b2b21feddfc
SHA512

18a62bf4678e63600a568202990d9f736e7ce46f305895bd94cde6be522a8c480762050944ec7767a39d865972a478e3a2bb31c22e9782630d99cc34c3b19564

Score

10^/10

hancitor 1112_783223 downloader

Malware Config

Extracted

Family

hancitor

Botnet

1112_783223

C2

http://magenvire.com/4/forum.php

http://boutimsami.ru/4/forum.php

http://adinend.ru/4/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1012 set thread context of 1776	1012	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

svchost.exe

pid	Process
1776	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1944 wrote to memory of 1012	1944	rundll32.exe	27
PID 1944 wrote to memory of 1012	1944	rundll32.exe	27
PID 1944 wrote to memory of 1012	1944	rundll32.exe	27
PID 1944 wrote to memory of 1012	1944	rundll32.exe	27
PID 1944 wrote to memory of 1012	1944	rundll32.exe	27
PID 1944 wrote to memory of 1012	1944	rundll32.exe	27
PID 1944 wrote to memory of 1012	1944	rundll32.exe	27
PID 1012 wrote to memory of 1776	1012	rundll32.exe	28
PID 1012 wrote to memory of 1776	1012	rundll32.exe	28
PID 1012 wrote to memory of 1776	1012	rundll32.exe	28
PID 1012 wrote to memory of 1776	1012	rundll32.exe	28
PID 1012 wrote to memory of 1776	1012	rundll32.exe	28
PID 1012 wrote to memory of 1776	1012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f1be0bf22eb9c01ecfd1a9d8a9fbe46ce103567a3876d9c28ab8b2b21feddfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f1be0bf22eb9c01ecfd1a9d8a9fbe46ce103567a3876d9c28ab8b2b21feddfc.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-54-0x0000000000000000-mapping.dmp

Download
memory/1012-55-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download
memory/1012-60-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download
memory/1012-62-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download
memory/1012-64-0x0000000000160000-0x0000000000169000-memory.dmp

Filesize
36KB

Download
memory/1776-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1776-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1776-59-0x0000000000402960-mapping.dmp

Download
memory/1776-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1776-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1776-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads