Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2024 07:37
Static task
static1
Behavioral task
behavioral1
Sample
8bc41922aa2635dbce28dbedf8c7c332.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8bc41922aa2635dbce28dbedf8c7c332.dll
Resource
win10v2004-20231215-en
General
-
Target
8bc41922aa2635dbce28dbedf8c7c332.dll
-
Size
348KB
-
MD5
8bc41922aa2635dbce28dbedf8c7c332
-
SHA1
8f08e4b153a817acde40c1e32d1b5343ece8cc0b
-
SHA256
98a4c62581108b0c40bb18ff399c661a4f3e9678b680b03e36bc42afd40281e8
-
SHA512
ec5ec0a6736982d7bf41e50c8764cfb363ac8f54244961fd1ba94db69442aaa9dd0ce67b31a094574506741acd006938f585e70a7e1f175efd2c7944942ff7b7
-
SSDEEP
6144:h3hEPz1JqXgnzmRPIwDLjKvKfF/AOtJ4pwafZ8FGW:huzzwJDTF/HJ2waWFGW
Malware Config
Extracted
hancitor
3008_hsdj8
http://buichely.com/8/forum.php
http://gratimen.ru/8/forum.php
http://waliteriter.ru/8/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 38 764 rundll32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 37 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 764 rundll32.exe 764 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 224 wrote to memory of 764 224 rundll32.exe 82 PID 224 wrote to memory of 764 224 rundll32.exe 82 PID 224 wrote to memory of 764 224 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bc41922aa2635dbce28dbedf8c7c332.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bc41922aa2635dbce28dbedf8c7c332.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:764
-