Find similar analyses in TI Lookup
Analysis date (UTC): 9 March 2022, 17:19Analysis environment: Windows 7 Pro, build 7601, x86

extracted_at_0x22a7b.exe

MD5:70B2822E6CF4AB4CDE9808B0DBA3A9DD
SHA1:B1FD55A1F2DD19F72E6435E27E18B1F0F1BFC925
SHA256:0D7AA23A72D22DCF47F8723C58D101B3B113CBC79DD407A6FAC0E65D67076EA1

Analysis result

Threat level:Malicious activity
Tags:
maldoc-57evasiontrojanhancitor
Full analysis:Analysis extracted_at_0x22a7b.exe (MD5: 70B2822E6CF4AB4CDE9808B0DBA3A9DD) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Connects to CnC server

  • rundll32.exe (PID: 3528)

HANCITOR was detected

  • rundll32.exe (PID: 3528)

SUSPICIOUS

Checks for external IP

  • rundll32.exe (PID: 3528)

INFO

Checks supported languages

  • rundll32.exe (PID: 3528)

Reads the computer name

  • rundll32.exe (PID: 3528)

Loads main object executable

  • rundll32.exe (PID: 3528)

Threats

PIDProcessClassMessage
3528rundll32.exePotential Corporate Privacy ViolationET POLICY External IP Lookup api.ipify.org
3528rundll32.exeA Network Trojan was detectedET TROJAN Tordal/Hancitor/Chanitor Checkin
3528rundll32.exeA Network Trojan was detectedET TROJAN Tordal/Hancitor/Chanitor Checkin

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED