hancitor | ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1

Analysis

max time kernel
134s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:17

Target

ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll
Size

389KB
MD5

3888ee32790cbc607488b6dd0059c3ad
SHA1

86774f9319e7c333865c1daf1d592a8ceaf615d7
SHA256

ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1
SHA512

75dc3ed4b4e101d9b17d598a968fe8aa3d5a0ce7a54a8db285ab1b759917f08e4644edf9c1834e11e1d7b0823d2d02e935b678c7f672c076dde038e049e85e5a
SSDEEP

12288:V17lp2D7gWtUSvuWZJT34myr2H/BRGbmaROM0:VVSsET38risLRx

Score

10^/10

Family

hancitor

Botnet

2502_ser3402

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	380	rundll32.exe
19	380	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
380	rundll32.exe
380	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 380	4668	rundll32.exe	82
PID 4668 wrote to memory of 380	4668	rundll32.exe	82
PID 4668 wrote to memory of 380	4668	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb554e33d5ff0006eb80c892037d4eae038d4cea0f51742a53412db161da1e1.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:380

memory/380-133-0x0000000075000000-0x000000007500A000-memory.dmp

Filesize
40KB

Download
memory/380-134-0x0000000075000000-0x00000000750B0000-memory.dmp

Filesize
704KB

Download
memory/380-135-0x0000000075000000-0x00000000750B0000-memory.dmp

Filesize
704KB

Download