hancitor | 920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 05:13

Target

920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll
Size

147KB
MD5

22aabe3eed3f6fd38b2ee4b69e5aeacb
SHA1

801356a456b59b0bd3fbcd664196e5bbab6365a1
SHA256

920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02
SHA512

6cae88e4be4d1e6e928fc09deb8d88d138d9eafca077cd29444898b62af2ca77981546c5ab61da69cb1f459dfcf9da0745fbc975e09a94efe0f097518cc84046

Score

10^/10

Family

hancitor

Botnet

2810_3264743

http://pubarecaz.com/4/forum.php

http://cremicies.ru/4/forum.php

http://thempotryk.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 960	1980	rundll32.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
960	svchost.exe
960	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1980	908	rundll32.exe	27
PID 908 wrote to memory of 1980	908	rundll32.exe	27
PID 908 wrote to memory of 1980	908	rundll32.exe	27
PID 908 wrote to memory of 1980	908	rundll32.exe	27
PID 908 wrote to memory of 1980	908	rundll32.exe	27
PID 908 wrote to memory of 1980	908	rundll32.exe	27
PID 908 wrote to memory of 1980	908	rundll32.exe	27
PID 1980 wrote to memory of 960	1980	rundll32.exe	28
PID 1980 wrote to memory of 960	1980	rundll32.exe	28
PID 1980 wrote to memory of 960	1980	rundll32.exe	28
PID 1980 wrote to memory of 960	1980	rundll32.exe	28
PID 1980 wrote to memory of 960	1980	rundll32.exe	28
PID 1980 wrote to memory of 960	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:960

memory/960-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000000120000-0x0000000000129000-memory.dmp

Filesize
36KB

Download
memory/1980-63-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/1980-61-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/1980-64-0x0000000000120000-0x0000000000129000-memory.dmp

Filesize
36KB

Download