hancitor | ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a

Analysis

max time kernel
74s
max time network
134s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:17

Target

ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a.dll
Size

389KB
MD5

692761c6b17324c796a10e3942ed49cc
SHA1

804be5f7628922bb1f22d7accde22fba7e497568
SHA256

ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a
SHA512

dd4682e9f795e6a015acfacd8cd1b2fefde73755c89c8052d2065d3daf7d461141343aedd0b32eeffa2adc3bedb05defbad6236ca8165916178ee8a15b04016f
SSDEEP

12288:V17lp2D7gWtUSvuWZJ634myr2H/BRGbmaROt:VVSsE638risLR

Score

10^/10

Family

hancitor

Botnet

2502_ser3402

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

5 2008 rundll32.exe
7 2008 rundll32.exe
9 2008 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2008 rundll32.exe

flow	ioc
4	api.ipify.org

pid	process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1932 wrote to memory of 2008	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2008	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2008	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2008	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2008	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2008	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2008	1932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/2008-56-0x0000000075330000-0x000000007533A000-memory.dmp

Filesize
40KB

Download
memory/2008-57-0x0000000075330000-0x00000000753E0000-memory.dmp

Filesize
704KB

Download
memory/2008-58-0x0000000075330000-0x00000000753E0000-memory.dmp

Filesize
704KB

Download