hancitor | 42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

General

Target

42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d.dll
Size

136KB
MD5

dda7f3bb9dee24e6e2564ed656f1bf64
SHA1

e1ff05e4be55cae9a5d2035f40e923bbdda4b90c
SHA256

42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d
SHA512

b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Score

10^/10

Family

hancitor

Botnet

1212_78342432

C2

http://vistiver.com/4/forum.php

http://thimemple.ru/4/forum.php

http://capandotd.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1276 set thread context of 1508 1276 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

svchost.exe

pid process

1508 svchost.exe

flow	ioc
3	api.ipify.org

description	pid	process	target process
PID 1276 set thread context of 1508	1276	rundll32.exe	svchost.exe

pid	process
1508	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 1276	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1276	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1276	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1276	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1276	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1276	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1276	1824	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1508	1276	rundll32.exe	svchost.exe
PID 1276 wrote to memory of 1508	1276	rundll32.exe	svchost.exe
PID 1276 wrote to memory of 1508	1276	rundll32.exe	svchost.exe
PID 1276 wrote to memory of 1508	1276	rundll32.exe	svchost.exe
PID 1276 wrote to memory of 1508	1276	rundll32.exe	svchost.exe
PID 1276 wrote to memory of 1508	1276	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1508

memory/1276-65-0x0000000000100000-0x0000000000109000-memory.dmp

Filesize
36KB

Download
memory/1276-55-0x0000000075E41000-0x0000000075E43000-memory.dmp

Filesize
8KB

Download
memory/1276-56-0x0000000000100000-0x0000000000109000-memory.dmp

Filesize
36KB

Download
memory/1276-57-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1276-64-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1276-62-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1276-54-0x0000000000000000-mapping.dmp

Download
memory/1508-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1508-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1508-61-0x0000000000402960-mapping.dmp

Download
memory/1508-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1508-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1508-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download