hancitor | 86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78

Analysis

Target

86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll
Size

147KB
MD5

001cb29837377a874dc8cbc0decd6021
SHA1

a17bf6c18013819271d0069ae31e9c812d89a085
SHA256

86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78
SHA512

11b791c6cb33da3a51d8576b917d721ae01f896add9fee73a733ff3280ac427d8640e2fa5dfb2b4ead85693b2693efb76e52afc97d7ebc93b451edcef9edb3be

Score

10^/10

Family

hancitor

Botnet

2310_3274823

http://sagitecheadle.com/4/forum.php

http://durestuasben.ru/4/forum.php

http://vladiondul.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3176 set thread context of 3616 3176 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

svchost.exe

pid process

3616 svchost.exe
3616 svchost.exe
3616 svchost.exe
3616 svchost.exe

flow	ioc
3	api.ipify.org

description	pid	process	target process
PID 3176 set thread context of 3616	3176	rundll32.exe	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2948 wrote to memory of 3176	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 3176	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 3176	2948	rundll32.exe	rundll32.exe
PID 3176 wrote to memory of 3616	3176	rundll32.exe	svchost.exe
PID 3176 wrote to memory of 3616	3176	rundll32.exe	svchost.exe
PID 3176 wrote to memory of 3616	3176	rundll32.exe	svchost.exe
PID 3176 wrote to memory of 3616	3176	rundll32.exe	svchost.exe
PID 3176 wrote to memory of 3616	3176	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616

memory/3176-130-0x0000000000000000-mapping.dmp

Download
memory/3176-131-0x0000000000F40000-0x0000000000F49000-memory.dmp

Filesize
36KB

Download
memory/3176-135-0x0000000000F40000-0x0000000000F49000-memory.dmp

Filesize
36KB

Download
memory/3176-136-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Filesize
48KB

Download
memory/3616-132-0x0000000000000000-mapping.dmp

Download
memory/3616-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download