hancitor | 7b59192a649ebb45a0210969aa8f1cae606189f02515bf871612a7711363e18b

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2024 01:35

Target

cf97b191a0b3f6f5dd6cf24ac8c1f5d9.dll
Size

291KB
MD5

cf97b191a0b3f6f5dd6cf24ac8c1f5d9
SHA1

1c759c7bcaba31fcf91ddf2c327c4ae463fef4f9
SHA256

7b59192a649ebb45a0210969aa8f1cae606189f02515bf871612a7711363e18b
SHA512

cee5cfa359affc9357c7dcbdbe94bb825fc381ae0253c4dcfc21c2303a6a0c5f759eb03ff7a9cb011ee1b7f71f2d8d6459ca4abaca5a0a8b3bdc65ce8d998179
SSDEEP

6144:FzU8/N+o/63hq1NcmZglxvDf7U9RG7yH+:mM+pJmWlhWQi+

Score

10^/10

Family

hancitor

Botnet

0607_qxwd0

http://hosouggs.com/8/forum.php

http://mancause.ru/8/forum.php

http://hievescits.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

35 5032 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

34 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

5032 rundll32.exe
5032 rundll32.exe
5032 rundll32.exe
5032 rundll32.exe

flow	pid	process
35	5032	rundll32.exe

flow	ioc
34	api.ipify.org

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3456 wrote to memory of 5032	3456	rundll32.exe	rundll32.exe
PID 3456 wrote to memory of 5032	3456	rundll32.exe	rundll32.exe
PID 3456 wrote to memory of 5032	3456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf97b191a0b3f6f5dd6cf24ac8c1f5d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf97b191a0b3f6f5dd6cf24ac8c1f5d9.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:5032

memory/5032-0-0x0000000075320000-0x000000007540D000-memory.dmp

Filesize
948KB

Download
memory/5032-2-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/5032-1-0x0000000075320000-0x000000007540D000-memory.dmp

Filesize
948KB

Download
memory/5032-3-0x0000000075320000-0x000000007540D000-memory.dmp

Filesize
948KB

Download
memory/5032-5-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download