hancitor | 86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78

Analysis

Target
86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll
Size 147KB
Sample220701-gwp17aghf2
SHA256 86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78
MD5 001cb29837377a874dc8cbc0decd6021
SHA1 a17bf6c18013819271d0069ae31e9c812d89a085
SHA512 11b791c6cb33da3a51d8576b917d721ae01f896add9fee73a733ff3280ac427d8640e2fa5dfb2b4ead85693b2693efb76e52afc97d7ebc93b451edcef9edb3be
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 3616	3176	rundll32.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3176	2948	rundll32.exe	80
PID 2948 wrote to memory of 3176	2948	rundll32.exe	80
PID 2948 wrote to memory of 3176	2948	rundll32.exe	80
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81
PID 3176 wrote to memory of 3616	3176	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86604666fbc6481a6be95303d14100bd65e1ea9248f6a6d1e6babec9b8de2d78.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3616

memory/3176-131-0x0000000000F40000-0x0000000000F49000-memory.dmp

Download

memory/3176-135-0x0000000000F40000-0x0000000000F49000-memory.dmp

Download

memory/3176-136-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Download

memory/3616-133-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3616-137-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3616-138-0x0000000000400000-0x0000000000409000-memory.dmp

Download