Analysis
-
max time kernel
189s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 03:13
Static task
static1
Behavioral task
behavioral1
Sample
72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll
Resource
win10v2004-20220414-en
General
-
Target
72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll
-
Size
30KB
-
MD5
c474f5108e6d3681049af55c62026661
-
SHA1
674b43ec6d8d6494c70917c2cc0478259ce8ffc1
-
SHA256
72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b
-
SHA512
205bf99637067523f3a179ab6eae6c5bd741d7bff06e54031d573ed0c1e25c5a1b6d3a47adc3f6b4341ad98426cfd839d589a031472be344e1e66916e755eec3
Malware Config
Extracted
hancitor
3010_2312321
http://hurampronand.com/4/forum.php
http://probominku.ru/4/forum.php
http://theintrughe.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 5088 set thread context of 2532 5088 rundll32.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
svchost.exepid process 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 5000 wrote to memory of 5088 5000 rundll32.exe rundll32.exe PID 5000 wrote to memory of 5088 5000 rundll32.exe rundll32.exe PID 5000 wrote to memory of 5088 5000 rundll32.exe rundll32.exe PID 5088 wrote to memory of 2532 5088 rundll32.exe svchost.exe PID 5088 wrote to memory of 2532 5088 rundll32.exe svchost.exe PID 5088 wrote to memory of 2532 5088 rundll32.exe svchost.exe PID 5088 wrote to memory of 2532 5088 rundll32.exe svchost.exe PID 5088 wrote to memory of 2532 5088 rundll32.exe svchost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-