hancitor | 7b59192a649ebb45a0210969aa8f1cae606189f02515bf871612a7711363e18b

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17-03-2024 01:35

Target

cf97b191a0b3f6f5dd6cf24ac8c1f5d9.dll
Size

291KB
MD5

cf97b191a0b3f6f5dd6cf24ac8c1f5d9
SHA1

1c759c7bcaba31fcf91ddf2c327c4ae463fef4f9
SHA256

7b59192a649ebb45a0210969aa8f1cae606189f02515bf871612a7711363e18b
SHA512

cee5cfa359affc9357c7dcbdbe94bb825fc381ae0253c4dcfc21c2303a6a0c5f759eb03ff7a9cb011ee1b7f71f2d8d6459ca4abaca5a0a8b3bdc65ce8d998179
SSDEEP

6144:FzU8/N+o/63hq1NcmZglxvDf7U9RG7yH+:mM+pJmWlhWQi+

Score

10^/10

Family

hancitor

Botnet

0607_qxwd0

http://hosouggs.com/8/forum.php

http://mancause.ru/8/forum.php

http://hievescits.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	3064	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3064	rundll32.exe
3064	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf97b191a0b3f6f5dd6cf24ac8c1f5d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf97b191a0b3f6f5dd6cf24ac8c1f5d9.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

memory/3064-0-0x0000000075030000-0x000000007511D000-memory.dmp

Filesize
948KB

Download
memory/3064-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3064-3-0x0000000075030000-0x000000007511D000-memory.dmp

Filesize
948KB

Download
memory/3064-5-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3064-17-0x0000000075030000-0x000000007511D000-memory.dmp

Filesize
948KB

Download