hancitor | 5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058

Analysis

max time kernel
80s
max time network
127s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:07

Target

5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll
Size

201KB
MD5

d240a34a8d3dd8c479346b5fca4dbd89
SHA1

93b869d50c12e2ecbc1927ef64a13bcdcd5ba816
SHA256

5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058
SHA512

525ce03a1c7e299edec17b0f2aba986471c8f5f0f7884b6d8c97c37594d0813b5391f85edde7c3a91c4ad729657387dbee57e345d02f5df40e83064ecfb00828
SSDEEP

3072:XWjbxamdPuF2AuvJl1NqSQUGtKI0qAmTmWjPSUduW3XrciT+PeaVYCs:XWjl2FJuvJXQzcIdy4us7ciT+PVYD

Score

10^/10

Family

hancitor

Botnet

2202_pro23

http://aftereand.com/8/forum.php

http://nevemicies.ru/8/forum.php

http://froplivernat.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 968 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

968 rundll32.exe

flow	pid	process
5	968	rundll32.exe

flow	ioc
4	api.ipify.org

pid	process
968	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 968	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 968	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 968	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 968	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 968	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 968	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 968	1696	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:968

memory/968-54-0x0000000000000000-mapping.dmp

Download
memory/968-55-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/968-56-0x0000000074C40000-0x0000000074C7E000-memory.dmp

Filesize
248KB

Download
memory/968-57-0x0000000074C40000-0x0000000074C4A000-memory.dmp

Filesize
40KB

Download
memory/968-58-0x0000000074C40000-0x0000000074C7E000-memory.dmp

Filesize
248KB

Download