hancitor | 5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 21:07

Target

5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll
Size

201KB
MD5

d240a34a8d3dd8c479346b5fca4dbd89
SHA1

93b869d50c12e2ecbc1927ef64a13bcdcd5ba816
SHA256

5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058
SHA512

525ce03a1c7e299edec17b0f2aba986471c8f5f0f7884b6d8c97c37594d0813b5391f85edde7c3a91c4ad729657387dbee57e345d02f5df40e83064ecfb00828
SSDEEP

3072:XWjbxamdPuF2AuvJl1NqSQUGtKI0qAmTmWjPSUduW3XrciT+PeaVYCs:XWjl2FJuvJXQzcIdy4us7ciT+PVYD

Score

10^/10

Family

hancitor

Botnet

2202_pro23

http://aftereand.com/8/forum.php

http://nevemicies.ru/8/forum.php

http://froplivernat.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	4752	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 4752	2812	rundll32.exe	82
PID 2812 wrote to memory of 4752	2812	rundll32.exe	82
PID 2812 wrote to memory of 4752	2812	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4752

memory/4752-133-0x00000000756B0000-0x00000000756BA000-memory.dmp

Filesize
40KB

Download
memory/4752-134-0x00000000756B0000-0x00000000756EE000-memory.dmp

Filesize
248KB

Download
memory/4752-135-0x00000000756B0000-0x00000000756EE000-memory.dmp

Filesize
248KB

Download