hancitor | 86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78

Analysis

Target

86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll
Size

147KB
MD5

001cb29837377a874dc8cbc0decd6021
SHA1

a17bf6c18013819271d0069ae31e9c812d89a085
SHA256

86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78
SHA512

11b791c6cb33da3a51d8576b917d721ae01f896add9fee73a733ff3280ac427d8640e2fa5dfb2b4ead85693b2693efb76e52afc97d7ebc93b451edcef9edb3be

Score

10^/10

Family

hancitor

Botnet

2310_3274823

http://sagitecheadle.com/4/forum.php

http://durestuasben.ru/4/forum.php

http://vladiondul.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 3616	3176	rundll32.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3176	2948	rundll32.exe	80
PID 2948 wrote to memory of 3176	2948	rundll32.exe	80
PID 2948 wrote to memory of 3176	2948	rundll32.exe	80
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3616

memory/3176-131-0x0000000000F40000-0x0000000000F49000-memory.dmp

Filesize
36KB

Download
memory/3176-135-0x0000000000F40000-0x0000000000F49000-memory.dmp

Filesize
36KB

Download
memory/3176-136-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Filesize
48KB

Download
memory/3616-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download