File name:

extracted_at_0x22a7b.exe

Full analysis: https://app.any.run/tasks/2211f4a0-81e4-432d-87a8-c7c285a5a919
Verdict: Malicious activity
Threats:

Hancitor was created in 2014 to drop other malware on infected machines. It is also known as Tordal and Chanitor. This malware is available as a service which makes it accessible tools to criminals and contributes to the popularity of this virus.

Analysis date: March 09, 2022, 17:19:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
maldoc-57
evasion
trojan
hancitor
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5:

70B2822E6CF4AB4CDE9808B0DBA3A9DD

SHA1:

B1FD55A1F2DD19F72E6435E27E18B1F0F1BFC925

SHA256:

0D7AA23A72D22DCF47F8723C58D101B3B113CBC79DD407A6FAC0E65D67076EA1

SSDEEP:

12288:opJeAgH7cp2N6VGh/aOn2EvHmCvAz8/L+RND7aq/mnYiQ6JM9M/:orVgYpNGhCOndGCl/LSD7aq/Iq9M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • HANCITOR was detected

      • rundll32.exe (PID: 3528)
    • Connects to CnC server

      • rundll32.exe (PID: 3528)
  • SUSPICIOUS

    • Checks for external IP

      • rundll32.exe (PID: 3528)
  • INFO

    • Loads main object executable

      • rundll32.exe (PID: 3528)
    • Checks supported languages

      • rundll32.exe (PID: 3528)
    • Reads the computer name

      • rundll32.exe (PID: 3528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 524288
InitializedDataSize: 116224
UninitializedDataSize: 0
EntryPoint: 0x80e64
OSVersion: 4
ImageVersion: 0
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • Russian - Russia

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_DLL
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x0007FEA8
0x00080000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.53098
DATA
0x00081000
0x000017A8
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.33722
BSS
0x00083000
0x00000D15
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00084000
0x00002344
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.89099
.reloc
0x00087000
0x00009344
0x00009400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.65457
.rsrc
0x00091000
0x0000F600
0x0000F600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.33695

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.85232
744
UNKNOWN
Russian - Russia
RT_ICON
2
2.80231
308
UNKNOWN
UNKNOWN
RT_CURSOR
3
3.00046
308
UNKNOWN
UNKNOWN
RT_CURSOR
4
2.56318
308
UNKNOWN
UNKNOWN
RT_CURSOR
5
2.6949
308
UNKNOWN
UNKNOWN
RT_CURSOR
6
2.62527
308
UNKNOWN
UNKNOWN
RT_CURSOR
7
2.91604
308
UNKNOWN
UNKNOWN
RT_CURSOR
8
2.6633
308
UNKNOWN
UNKNOWN
RT_CURSOR
4077
2.80202
232
UNKNOWN
UNKNOWN
RT_STRING
4078
3.33239
488
UNKNOWN
UNKNOWN
RT_STRING
4080
3.34838
980
UNKNOWN
UNKNOWN
RT_STRING
4081
3.22434
476
UNKNOWN
UNKNOWN
RT_STRING
4082
3.2356
340
UNKNOWN
UNKNOWN
RT_STRING
4083
3.222
576
UNKNOWN
UNKNOWN
RT_STRING
4084
3.27477
432
UNKNOWN
UNKNOWN
RT_STRING
4085
3.10835
232
UNKNOWN
UNKNOWN
RT_STRING
4086
3.1381
312
UNKNOWN
UNKNOWN
RT_STRING
4087
3.2613
956
UNKNOWN
UNKNOWN
RT_STRING
4088
3.18138
920
UNKNOWN
UNKNOWN
RT_STRING
4089
3.22463
952
UNKNOWN
UNKNOWN
RT_STRING
4090
3.25677
944
UNKNOWN
UNKNOWN
RT_STRING
4091
2.96358
240
UNKNOWN
UNKNOWN
RT_STRING
4092
2.80205
192
UNKNOWN
UNKNOWN
RT_STRING
4093
3.26196
728
UNKNOWN
UNKNOWN
RT_STRING
4094
3.22866
1156
UNKNOWN
UNKNOWN
RT_STRING
4095
3.24474
940
UNKNOWN
UNKNOWN
RT_STRING
4096
3.18309
724
UNKNOWN
UNKNOWN
RT_STRING
32761
2.01924
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR
32762
1.91924
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR
32763
2.01924
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR
32764
2.01924
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR
32765
2.01924
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR
32766
2.01924
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR
32767
2.01924
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR
R1
7.39841
30212
UNKNOWN
Russian - Russia
F1
BBABORT
2.92079
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBALL
3.16995
484
UNKNOWN
UNKNOWN
RT_BITMAP
BBCANCEL
2.92079
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBCLOSE
3.68492
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBHELP
2.88085
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBIGNORE
3.29718
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBNO
3.58804
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBOK
2.67459
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBRETRY
3.53344
464
UNKNOWN
UNKNOWN
RT_BITMAP
BBYES
2.67459
464
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_CANCEL
2.48195
312
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_DELETE
1.96211
312
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_EDIT
2.03231
312
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_FIRST
2.35476
312
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_INSERT
2.30222
312
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_LAST
2.36078
312
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_NEXT
2.98591
260
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_POST
2.29306
312
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_PRIOR
2.95641
260
UNKNOWN
UNKNOWN
RT_BITMAP
DBN_REFRESH
2.62011
312
UNKNOWN
UNKNOWN
RT_BITMAP
PREVIEWGLYPH
2.85172
232
UNKNOWN
UNKNOWN
RT_BITMAP
DLGTEMPLATE
2.5627
82
UNKNOWN
UNKNOWN
RT_DIALOG
DVCLAL
4
16
UNKNOWN
UNKNOWN
RT_RCDATA
PACKAGEINFO
5.35936
952
UNKNOWN
UNKNOWN
RT_RCDATA
TFORM1
5.46989
722
UNKNOWN
UNKNOWN
RT_RCDATA
TFORM2
5.6121
692
UNKNOWN
UNKNOWN
RT_RCDATA
TLOGINDIALOG
5.41656
1172
UNKNOWN
UNKNOWN
RT_RCDATA
TPASSWORDDIALOG
5.41548
964
UNKNOWN
UNKNOWN
RT_RCDATA
TEE_CURSOR_HAND
1.83876
20
UNKNOWN
UNKNOWN
RT_GROUP_CURSOR

Imports

advapi32.dll
comctl32.dll
gdi32.dll
kernel32.dll
ole32.dll
oleaut32.dll
user32.dll
version.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #HANCITOR rundll32.exe

Process information

PID
CMD
Path
Indicators
Parent process
3528"C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\extracted_at_0x22a7b.exe", #1C:\Windows\System32\rundll32.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\users\admin\appdata\local\temp\extracted_at_0x22a7b.exe
c:\windows\system32\version.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\logoncli.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wship6.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\wshqos.dll
Total events
319
Read events
307
Write events
12
Delete events
0

Modification events

(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionTime
Value:
C60E7FD7D933D801
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadNetworkName
Value:
Network 4
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionTime
Value:
C60E7FD7D933D801
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(3528) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
4
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3528
rundll32.exe
GET
200
3.220.57.224:80
http://api.ipify.org/
US
text
12 b
shared
3528
rundll32.exe
POST
194.67.71.155:80
http://sameastar.ru/8/forum.php
RU
malicious
3528
rundll32.exe
POST
194.67.71.130:80
http://ludiesibut.ru/8/forum.php
RU
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3528
rundll32.exe
3.220.57.224:80
api.ipify.org
US
malicious
3528
rundll32.exe
194.67.71.130:80
ludiesibut.ru
RADIO-FSU/RADIO-MSU NETWORK Ltd
RU
malicious
3528
rundll32.exe
194.67.71.155:80
sameastar.ru
RADIO-FSU/RADIO-MSU NETWORK Ltd
RU
malicious

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 3.220.57.224
  • 52.20.78.240
  • 3.232.242.170
  • 54.91.59.199
shared
satursed.com
malicious
sameastar.ru
  • 194.67.71.155
malicious
ludiesibut.ru
  • 194.67.71.130
malicious

Threats

PID
Process
Class
Message
3528
rundll32.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup api.ipify.org
3528
rundll32.exe
A Network Trojan was detected
ET TROJAN Tordal/Hancitor/Chanitor Checkin
3528
rundll32.exe
A Network Trojan was detected
ET TROJAN Tordal/Hancitor/Chanitor Checkin
No debug info