hancitor | efbdd00df327459c9db2ffc79b2408f7f3c60e8ba5f8c5ffd0debaff986863a8

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:19

Target

2172fdc8532872295d309682c5f323d9.dll
Size

400KB
MD5

2172fdc8532872295d309682c5f323d9
SHA1

a539b7fcb7706ade3f5a3e9b01c27ae2399fbe61
SHA256

efbdd00df327459c9db2ffc79b2408f7f3c60e8ba5f8c5ffd0debaff986863a8
SHA512

7aa5c086f027fe6a2507389b9b3f0390649e8ab4f3080c89827dfcbfbf3ede5d9df5f9b385a3596f1b7bb0a9d80b330edee7a9b88c868090f7d9ce151e862191
SSDEEP

12288:LV3KhhWj6TCPmLpGGFk7ZioaZUp6I/nS049:rj6smL+dAZE6Ig

Score

10^/10

Family

hancitor

Botnet

2508_bqplf

http://intakinger.com/8/forum.php

http://idgentexpliet.ru/8/forum.php

http://declassivan.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

36 1172 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

35 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1172 rundll32.exe
1172 rundll32.exe
1172 rundll32.exe
1172 rundll32.exe

flow	pid	process
36	1172	rundll32.exe

flow	ioc
35	api.ipify.org

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 1172	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1172	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1172	960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2172fdc8532872295d309682c5f323d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

memory/1172-0-0x0000000010000000-0x0000000010078000-memory.dmp

Filesize
480KB

Download
memory/1172-2-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/1172-1-0x0000000010000000-0x0000000010078000-memory.dmp

Filesize
480KB

Download
memory/1172-3-0x0000000010000000-0x0000000010078000-memory.dmp

Filesize
480KB

Download