hancitor | ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1

Analysis

max time kernel
134s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:17

Target

ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll
Size

389KB
MD5

3888ee32790cbc607488b6dd0059c3ad
SHA1

86774f9319e7c333865c1daf1d592a8ceaf615d7
SHA256

ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1
SHA512

75dc3ed4b4e101d9b17d598a968fe8aa3d5a0ce7a54a8db285ab1b759917f08e4644edf9c1834e11e1d7b0823d2d02e935b678c7f672c076dde038e049e85e5a
SSDEEP

12288:V17lp2D7gWtUSvuWZJT34myr2H/BRGbmaROM0:VVSsET38risLRx

Score

10^/10

Family

hancitor

Botnet

2502_ser3402

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

17 380 rundll32.exe
19 380 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 api.ipify.org
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

380 rundll32.exe
380 rundll32.exe

flow	pid	process
17	380	rundll32.exe
19	380	rundll32.exe

flow	ioc
16	api.ipify.org

pid	process
380	rundll32.exe
380	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4668 wrote to memory of 380	4668	rundll32.exe	rundll32.exe
PID 4668 wrote to memory of 380	4668	rundll32.exe	rundll32.exe
PID 4668 wrote to memory of 380	4668	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668

memory/380-132-0x0000000000000000-mapping.dmp

Download
memory/380-133-0x0000000075000000-0x000000007500A000-memory.dmp

Filesize
40KB

Download
memory/380-134-0x0000000075000000-0x00000000750B0000-memory.dmp

Filesize
704KB

Download
memory/380-135-0x0000000075000000-0x00000000750B0000-memory.dmp

Filesize
704KB

Download