hancitor | ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1

Analysis

max time kernel
80s
max time network
133s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:17

Target

ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll
Size

389KB
MD5

3888ee32790cbc607488b6dd0059c3ad
SHA1

86774f9319e7c333865c1daf1d592a8ceaf615d7
SHA256

ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1
SHA512

75dc3ed4b4e101d9b17d598a968fe8aa3d5a0ce7a54a8db285ab1b759917f08e4644edf9c1834e11e1d7b0823d2d02e935b678c7f672c076dde038e049e85e5a
SSDEEP

12288:V17lp2D7gWtUSvuWZJT34myr2H/BRGbmaROM0:VVSsET38risLRx

Score

10^/10

Family

hancitor

Botnet

2502_ser3402

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

5 1928 rundll32.exe
7 1928 rundll32.exe
9 1928 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1928 rundll32.exe

flow	ioc
4	api.ipify.org

pid	process
1928	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1928	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1928	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1928	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1928	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1928	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1928	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1928	1948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

memory/1928-54-0x0000000000000000-mapping.dmp

Download
memory/1928-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1928-56-0x0000000074BE0000-0x0000000074BEA000-memory.dmp

Filesize
40KB

Download
memory/1928-57-0x0000000074BE0000-0x0000000074C90000-memory.dmp

Filesize
704KB

Download
memory/1928-58-0x0000000074BE0000-0x0000000074C90000-memory.dmp

Filesize
704KB

Download