hancitor | 72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b

Analysis

Target
72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll
Size 30KB
Sample220701-dqrfaahfgl
SHA256 72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b
MD5 c474f5108e6d3681049af55c62026661
SHA1 674b43ec6d8d6494c70917c2cc0478259ce8ffc1
SHA512 205bf99637067523f3a179ab6eae6c5bd741d7bff06e54031d573ed0c1e25c5a1b6d3a47adc3f6b4341ad98426cfd839d589a031472be344e1e66916e755eec3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 2532	5088	rundll32.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 5088	5000	rundll32.exe	80
PID 5000 wrote to memory of 5088	5000	rundll32.exe	80
PID 5000 wrote to memory of 5088	5000	rundll32.exe	80
PID 5088 wrote to memory of 2532	5088	rundll32.exe	81
PID 5088 wrote to memory of 2532	5088	rundll32.exe	81
PID 5088 wrote to memory of 2532	5088	rundll32.exe	81
PID 5088 wrote to memory of 2532	5088	rundll32.exe	81
PID 5088 wrote to memory of 2532	5088	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72ea69e2111ea6226787af8d0257f6773ed03bb47885dd3f5e86c4038dd4f96b.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2532

memory/2532-132-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2532-134-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2532-135-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2532-136-0x0000000000400000-0x0000000000409000-memory.dmp

Download