hancitor | 5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 21:07

Target

5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll
Size

201KB
MD5

d240a34a8d3dd8c479346b5fca4dbd89
SHA1

93b869d50c12e2ecbc1927ef64a13bcdcd5ba816
SHA256

5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058
SHA512

525ce03a1c7e299edec17b0f2aba986471c8f5f0f7884b6d8c97c37594d0813b5391f85edde7c3a91c4ad729657387dbee57e345d02f5df40e83064ecfb00828
SSDEEP

3072:XWjbxamdPuF2AuvJl1NqSQUGtKI0qAmTmWjPSUduW3XrciT+PeaVYCs:XWjl2FJuvJXQzcIdy4us7ciT+PVYD

Score

10^/10

Family

hancitor

Botnet

2202_pro23

http://aftereand.com/8/forum.php

http://nevemicies.ru/8/forum.php

http://froplivernat.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

16 4752 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

4752 rundll32.exe
4752 rundll32.exe
4752 rundll32.exe
4752 rundll32.exe

flow	pid	process
16	4752	rundll32.exe

flow	ioc
15	api.ipify.org

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2812 wrote to memory of 4752	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 4752	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 4752	2812	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cfa76abb7ddf699258ab72dc481101f4ace4c63325ab7f70147498c4e8b8058.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812

memory/4752-132-0x0000000000000000-mapping.dmp

Download
memory/4752-133-0x00000000756B0000-0x00000000756BA000-memory.dmp

Filesize
40KB

Download
memory/4752-134-0x00000000756B0000-0x00000000756EE000-memory.dmp

Filesize
248KB

Download
memory/4752-135-0x00000000756B0000-0x00000000756EE000-memory.dmp

Filesize
248KB

Download