hancitor | 86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78

General

Target

86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll
Size

147KB
MD5

001cb29837377a874dc8cbc0decd6021
SHA1

a17bf6c18013819271d0069ae31e9c812d89a085
SHA256

86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78
SHA512

11b791c6cb33da3a51d8576b917d721ae01f896add9fee73a733ff3280ac427d8640e2fa5dfb2b4ead85693b2693efb76e52afc97d7ebc93b451edcef9edb3be

Score

10^/10

Family

hancitor

Botnet

2310_3274823

C2

http://sagitecheadle.com/4/forum.php

http://durestuasben.ru/4/forum.php

http://vladiondul.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1664 set thread context of 1940 1664 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

svchost.exe

pid process

1940 svchost.exe
1940 svchost.exe

flow	ioc
3	api.ipify.org

description	pid	process	target process
PID 1664 set thread context of 1940	1664	rundll32.exe	svchost.exe

pid	process
1940	svchost.exe
1940	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 480 wrote to memory of 1664	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1664	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1664	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1664	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1664	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1664	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1664	480	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1940	1664	rundll32.exe	svchost.exe
PID 1664 wrote to memory of 1940	1664	rundll32.exe	svchost.exe
PID 1664 wrote to memory of 1940	1664	rundll32.exe	svchost.exe
PID 1664 wrote to memory of 1940	1664	rundll32.exe	svchost.exe
PID 1664 wrote to memory of 1940	1664	rundll32.exe	svchost.exe
PID 1664 wrote to memory of 1940	1664	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1940

memory/1664-54-0x0000000000000000-mapping.dmp

Download
memory/1664-55-0x0000000075941000-0x0000000075943000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x00000000001A0000-0x00000000001A9000-memory.dmp

Filesize
36KB

Download
memory/1664-63-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/1664-61-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/1664-65-0x00000000001A0000-0x00000000001A9000-memory.dmp

Filesize
36KB

Download
memory/1940-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1940-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1940-60-0x0000000000402960-mapping.dmp

Download
memory/1940-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1940-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1940-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download