hancitor | bb3cfed0b433c158af3238573507836cd6c42a40240852a0ae22bcfd48038b8c

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 17:30

Target

7d947a3d37f370b12fec5f1df82dfd1e.dll
Size

800KB
MD5

7d947a3d37f370b12fec5f1df82dfd1e
SHA1

e5999fccef4769c0c7ae66b9ec6eaaf7c3326c46
SHA256

bb3cfed0b433c158af3238573507836cd6c42a40240852a0ae22bcfd48038b8c
SHA512

9bf47cbfa989cbd55e48675b83799559cc7ffa40023520dfe072d4889872abe341d099e9915d96b7c5ef0aea05e554ec58dd0f91e3b0324f53d922dbd09b675f
SSDEEP

12288:holXVy6UibVx/dxXgDynQj3EKML/7k3mfdwgbwmoCcwciVVVV2D+03h:mllwIxXgD4U3EKML+4wm9cwuN

Score

10^/10

Family

hancitor

Botnet

1808_plfr

http://madmilons.com/8/forum.php

http://counteent.ru/8/forum.php

http://simatereare.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	1688	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1688	rundll32.exe
1688	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1688	2008	rundll32.exe	28
PID 2008 wrote to memory of 1688	2008	rundll32.exe	28
PID 2008 wrote to memory of 1688	2008	rundll32.exe	28
PID 2008 wrote to memory of 1688	2008	rundll32.exe	28
PID 2008 wrote to memory of 1688	2008	rundll32.exe	28
PID 2008 wrote to memory of 1688	2008	rundll32.exe	28
PID 2008 wrote to memory of 1688	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d947a3d37f370b12fec5f1df82dfd1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d947a3d37f370b12fec5f1df82dfd1e.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1688

memory/1688-0-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/1688-2-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/1688-1-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/1688-3-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/1688-5-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1688-7-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download