hancitor | f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac

Analysis

max time kernel
151s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 09:10

Target

f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac.dll
Size

174KB
MD5

227ddb5f8b75f0c253e466e0752f1d97
SHA1

e5361dbf2218d41e577bfff6355125bdda0c08db
SHA256

f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac
SHA512

108a06fcc33ae5b2a024a84f861f873efbd0cadffa8eddd575e1f3392f2ae2914aef253d3a7b2bfa445c61b83f9ceaf6224880d39c43d3bdfd0b3c5fa9b01d02

Score

10^/10

Family

hancitor

Botnet

2111_7654345

http://hismosedkaj.com/4/forum.php

http://consenhary.ru/4/forum.php

http://prolighmev.ru/4/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 1892	4448	rundll32.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4448	1180	rundll32.exe	82
PID 1180 wrote to memory of 4448	1180	rundll32.exe	82
PID 1180 wrote to memory of 4448	1180	rundll32.exe	82
PID 4448 wrote to memory of 1892	4448	rundll32.exe	83
PID 4448 wrote to memory of 1892	4448	rundll32.exe	83
PID 4448 wrote to memory of 1892	4448	rundll32.exe	83
PID 4448 wrote to memory of 1892	4448	rundll32.exe	83
PID 4448 wrote to memory of 1892	4448	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1892

memory/1892-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1892-134-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1892-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1892-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4448-136-0x0000000002A00000-0x0000000002A0C000-memory.dmp

Filesize
48KB

Download
memory/4448-135-0x00000000012B0000-0x00000000012B9000-memory.dmp

Filesize
36KB

Download