hancitor | 3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-04-2023 10:00

Target

3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630.dll
Size

486KB
MD5

3f756c0689209815a6519a83acfea461
SHA1

641c3834b4fd3209ebc2cce0cb5e9f35f382ad69
SHA256

3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630
SHA512

15d3f97bf4d98b6fa2bb14a32557c9469e76f3d0ee863a6f26919eb49b93aea6581dc58eec91fb91e3666af4de87a6b2588daa53539045e656ad1c291b3b29c6
SSDEEP

12288:Kf5NGH5+nA+R7L05les5ZlUEKoQNne3De0:2wZ+V7w5lesFUst

Score

10^/10

Family

hancitor

Botnet

2806_ldfa1

http://raeonoran.com/8/forum.php

http://duclowtionly.ru/8/forum.php

http://unteladenad.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
3	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
896	rundll32.exe
896	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1704 wrote to memory of 896	1704	rundll32.exe	27
PID 1704 wrote to memory of 896	1704	rundll32.exe	27
PID 1704 wrote to memory of 896	1704	rundll32.exe	27
PID 1704 wrote to memory of 896	1704	rundll32.exe	27
PID 1704 wrote to memory of 896	1704	rundll32.exe	27
PID 1704 wrote to memory of 896	1704	rundll32.exe	27
PID 1704 wrote to memory of 896	1704	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:896

memory/896-54-0x0000000000270000-0x00000000002EE000-memory.dmp

Filesize
504KB

Download
memory/896-55-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/896-56-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/896-57-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/896-58-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/896-60-0x0000000000270000-0x00000000002EE000-memory.dmp

Filesize
504KB

Download
memory/896-62-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download