hancitor | 2a8b737a4752060a308c4312b7c0cf6c05cde5b370906286dea9cdd36f5aa613

Analysis

max time kernel
132s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 04:01

Target

0524_4109399728218.doc_jax.dll
Size

704KB
MD5

9dc6f214fc82d637de2f68f3c519d339
SHA1

aaa425f7377d405bea59b8adfb65afc0c8869886
SHA256

2a8b737a4752060a308c4312b7c0cf6c05cde5b370906286dea9cdd36f5aa613
SHA512

5cb0a6f3ab48e5127d5c9f638c035dd4b3a97f3eb31334d5bc3eeafc164b31540fea65d6e40abfac8566676c43e954f567dbc2af81a629b4059af7e466d75bef
SSDEEP

12288:uC69N9C/hMHx8kzFfagPtKEp6E72y/N0hwOGt+gBd8x+6vLrD1ag:HKHaY8k5faaboEy6r8zz1

Score

10^/10

Family

hancitor

Botnet

2405_pin43

http://thowerteigime.com/8/forum.php

http://euvereginumet.ru/8/forum.php

http://rhopulforopme.ru/8/forum.php

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	4800	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4800	2000	rundll32.exe	83
PID 2000 wrote to memory of 4800	2000	rundll32.exe	83
PID 2000 wrote to memory of 4800	2000	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0524_4109399728218.doc_jax.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0524_4109399728218.doc_jax.dll,#1
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 640
    3⤵
    - Program crash
    PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 4800
1⤵
PID:4076

memory/4800-0-0x00000000020C0000-0x0000000002174000-memory.dmp

Filesize
720KB

Download
memory/4800-1-0x0000000002300000-0x0000000002308000-memory.dmp

Filesize
32KB

Download
memory/4800-2-0x0000000002320000-0x000000000232A000-memory.dmp

Filesize
40KB

Download
memory/4800-3-0x00000000020C0000-0x0000000002174000-memory.dmp

Filesize
720KB

Download