hancitor | f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac

Analysis

max time kernel
146s
max time network
154s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 09:10

Target

f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac.dll
Size

174KB
MD5

227ddb5f8b75f0c253e466e0752f1d97
SHA1

e5361dbf2218d41e577bfff6355125bdda0c08db
SHA256

f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac
SHA512

108a06fcc33ae5b2a024a84f861f873efbd0cadffa8eddd575e1f3392f2ae2914aef253d3a7b2bfa445c61b83f9ceaf6224880d39c43d3bdfd0b3c5fa9b01d02

Score

10^/10

Family

hancitor

Botnet

2111_7654345

http://hismosedkaj.com/4/forum.php

http://consenhary.ru/4/forum.php

http://prolighmev.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1768 set thread context of 892 1768 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

svchost.exe

pid process

892 svchost.exe
892 svchost.exe

flow	ioc
3	api.ipify.org

description	pid	process	target process
PID 1768 set thread context of 892	1768	rundll32.exe	svchost.exe

pid	process
892	svchost.exe
892	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1704 wrote to memory of 1768	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1768	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1768	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1768	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1768	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1768	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1768	1704	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 892	1768	rundll32.exe	svchost.exe
PID 1768 wrote to memory of 892	1768	rundll32.exe	svchost.exe
PID 1768 wrote to memory of 892	1768	rundll32.exe	svchost.exe
PID 1768 wrote to memory of 892	1768	rundll32.exe	svchost.exe
PID 1768 wrote to memory of 892	1768	rundll32.exe	svchost.exe
PID 1768 wrote to memory of 892	1768	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:892

memory/892-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/892-60-0x0000000000402960-mapping.dmp

Download
memory/892-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/892-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/892-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/892-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1768-54-0x0000000000000000-mapping.dmp

Download
memory/1768-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1768-56-0x00000000000B0000-0x00000000000B9000-memory.dmp

Filesize
36KB

Download
memory/1768-61-0x0000000000120000-0x000000000012C000-memory.dmp

Filesize
48KB

Download
memory/1768-62-0x0000000000120000-0x000000000012C000-memory.dmp

Filesize
48KB

Download
memory/1768-64-0x00000000000B0000-0x00000000000B9000-memory.dmp

Filesize
36KB

Download