hancitor | 72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b

General

Target

72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll
Size

30KB
MD5

c474f5108e6d3681049af55c62026661
SHA1

674b43ec6d8d6494c70917c2cc0478259ce8ffc1
SHA256

72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b
SHA512

205bf99637067523f3a179ab6eae6c5bd741d7bff06e54031d573ed0c1e25c5a1b6d3a47adc3f6b4341ad98426cfd839d589a031472be344e1e66916e755eec3

Score

10^/10

Family

hancitor

Botnet

3010_2312321

C2

http://hurampronand.com/4/forum.php

http://probominku.ru/4/forum.php

http://theintrughe.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
suricata: ET MALWARE Tordal/Hancitor/Chanitor Checkin
suricata: ET MALWARE Tordal/Hancitor/Chanitor Checkin
suricata
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 908 set thread context of 1632 908 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

svchost.exe

pid process

1632 svchost.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 908 set thread context of 1632	908	rundll32.exe	svchost.exe

pid	process
1632	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1220 wrote to memory of 908	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 908	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 908	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 908	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 908	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 908	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 908	1220	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1632	908	rundll32.exe	svchost.exe
PID 908 wrote to memory of 1632	908	rundll32.exe	svchost.exe
PID 908 wrote to memory of 1632	908	rundll32.exe	svchost.exe
PID 908 wrote to memory of 1632	908	rundll32.exe	svchost.exe
PID 908 wrote to memory of 1632	908	rundll32.exe	svchost.exe
PID 908 wrote to memory of 1632	908	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1632

memory/908-54-0x0000000000000000-mapping.dmp

Download
memory/908-55-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-59-0x0000000000402960-mapping.dmp

Download
memory/1632-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download