hancitor | ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a

Analysis

max time kernel
157s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:17

Target

ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a.dll
Size

389KB
MD5

692761c6b17324c796a10e3942ed49cc
SHA1

804be5f7628922bb1f22d7accde22fba7e497568
SHA256

ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a
SHA512

dd4682e9f795e6a015acfacd8cd1b2fefde73755c89c8052d2065d3daf7d461141343aedd0b32eeffa2adc3bedb05defbad6236ca8165916178ee8a15b04016f
SSDEEP

12288:V17lp2D7gWtUSvuWZJ634myr2H/BRGbmaROt:VVSsE638risLR

Score

10^/10

Family

hancitor

Botnet

2502_ser3402

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
8	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
1460	rundll32.exe
1460	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4924 wrote to memory of 1460	4924	rundll32.exe	80
PID 4924 wrote to memory of 1460	4924	rundll32.exe	80
PID 4924 wrote to memory of 1460	4924	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ead01441d35aeba42fd9b1d302a45b20cd6482ec5d39b02f1bffb265ee85702a.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

memory/1460-133-0x0000000000000000-mapping.dmp

Download
memory/1460-134-0x00000000752D0000-0x00000000752DA000-memory.dmp

Filesize
40KB

Download
memory/1460-135-0x00000000752D0000-0x0000000075380000-memory.dmp

Filesize
704KB

Download