Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 05:13
Static task
static1
Behavioral task
behavioral1
Sample
920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll
Resource
win10v2004-20220721-en
General
-
Target
920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll
-
Size
147KB
-
MD5
22aabe3eed3f6fd38b2ee4b69e5aeacb
-
SHA1
801356a456b59b0bd3fbcd664196e5bbab6365a1
-
SHA256
920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02
-
SHA512
6cae88e4be4d1e6e928fc09deb8d88d138d9eafca077cd29444898b62af2ca77981546c5ab61da69cb1f459dfcf9da0745fbc975e09a94efe0f097518cc84046
Malware Config
Extracted
hancitor
2810_3264743
http://pubarecaz.com/4/forum.php
http://cremicies.ru/4/forum.php
http://thempotryk.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 4180 set thread context of 4520 4180 rundll32.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
svchost.exepid process 4520 svchost.exe 4520 svchost.exe 4520 svchost.exe 4520 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1736 wrote to memory of 4180 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 4180 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 4180 1736 rundll32.exe rundll32.exe PID 4180 wrote to memory of 4520 4180 rundll32.exe svchost.exe PID 4180 wrote to memory of 4520 4180 rundll32.exe svchost.exe PID 4180 wrote to memory of 4520 4180 rundll32.exe svchost.exe PID 4180 wrote to memory of 4520 4180 rundll32.exe svchost.exe PID 4180 wrote to memory of 4520 4180 rundll32.exe svchost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\920b5a9f1288f07eabd9468d54c6b1c188a77999ec1947cd862f8bea31960b02.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4180-130-0x0000000000000000-mapping.dmp
-
memory/4180-135-0x0000000000820000-0x0000000000829000-memory.dmpFilesize
36KB
-
memory/4180-136-0x00000000009C0000-0x00000000009CC000-memory.dmpFilesize
48KB
-
memory/4520-131-0x0000000000000000-mapping.dmp
-
memory/4520-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4520-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4520-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4520-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB