hancitor | 3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630

Analysis

max time kernel
82s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2023 10:00

Target

3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630.dll
Size

486KB
MD5

3f756c0689209815a6519a83acfea461
SHA1

641c3834b4fd3209ebc2cce0cb5e9f35f382ad69
SHA256

3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630
SHA512

15d3f97bf4d98b6fa2bb14a32557c9469e76f3d0ee863a6f26919eb49b93aea6581dc58eec91fb91e3666af4de87a6b2588daa53539045e656ad1c291b3b29c6
SSDEEP

12288:Kf5NGH5+nA+R7L05les5ZlUEKoQNne3De0:2wZ+V7w5lesFUst

Score

10^/10

Family

hancitor

Botnet

2806_ldfa1

http://raeonoran.com/8/forum.php

http://duclowtionly.ru/8/forum.php

http://unteladenad.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3768 4716 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3768	4716	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 4716	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 4716	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 4716	2724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630.dll,#1
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 648
    3⤵
    - Program crash
    PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4716 -ip 4716
1⤵
PID:996

memory/4716-133-0x00000000011D0000-0x00000000011D8000-memory.dmp

Filesize
32KB

Download
memory/4716-134-0x00000000011F0000-0x00000000011FA000-memory.dmp

Filesize
40KB

Download
memory/4716-135-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download