Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
12-05-2020 18:52
Behavioral task
behavioral1
Sample
offer_05634.xlsm
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
offer_05634.xlsm
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
offer_05634.xlsm
-
Size
115KB
-
MD5
3e0bbe29e435b2a5bf66091b2bc4efcf
-
SHA1
af4abd629cf997d80e2a57a37c4fd6408097e324
-
SHA256
27ba6b6b56747320708fc658ba659bc5d3f77545453ee879cfc6ae210636786c
-
SHA512
1acd893cd2d57573221dec7ec553eb7f513902d34c8669c15469ec1ca5829d6524cc5c4623c9cf39e863d6203e83343ac1915d2ee24a6be0a2eafdfa353d5c4c
Malware Config
Extracted
Family
hancitor
Botnet
0405_784793234
C2
http://libuions.com/4/forum.php
http://feredrazac.ru/4/forum.php
http://urumerael.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3872 3216 regsvr32.exe 67 -
Loads dropped DLL 1 IoCs
pid Process 2520 regsvr32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2520 set thread context of 500 2520 regsvr32.exe 76 PID 500 set thread context of 3764 500 svchost.exe 81 -
Program crash 1 IoCs
pid pid_target Process procid_target 3396 2520 WerFault.exe 74 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3216 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 500 svchost.exe 500 svchost.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 3396 WerFault.exe 500 svchost.exe 500 svchost.exe 500 svchost.exe 500 svchost.exe -
Suspicious use of AdjustPrivilegeToken 67 IoCs
description pid Process Token: SeRestorePrivilege 3396 WerFault.exe Token: SeBackupPrivilege 3396 WerFault.exe Token: SeDebugPrivilege 3396 WerFault.exe Token: SeImpersonatePrivilege 500 svchost.exe Token: SeTcbPrivilege 500 svchost.exe Token: SeChangeNotifyPrivilege 500 svchost.exe Token: SeCreateTokenPrivilege 500 svchost.exe Token: SeBackupPrivilege 500 svchost.exe Token: SeRestorePrivilege 500 svchost.exe Token: SeIncreaseQuotaPrivilege 500 svchost.exe Token: SeAssignPrimaryTokenPrivilege 500 svchost.exe Token: SeImpersonatePrivilege 500 svchost.exe Token: SeTcbPrivilege 500 svchost.exe Token: SeChangeNotifyPrivilege 500 svchost.exe Token: SeCreateTokenPrivilege 500 svchost.exe Token: SeBackupPrivilege 500 svchost.exe Token: SeRestorePrivilege 500 svchost.exe Token: SeIncreaseQuotaPrivilege 500 svchost.exe Token: SeAssignPrimaryTokenPrivilege 500 svchost.exe Token: SeImpersonatePrivilege 500 svchost.exe Token: SeTcbPrivilege 500 svchost.exe Token: SeChangeNotifyPrivilege 500 svchost.exe Token: SeCreateTokenPrivilege 500 svchost.exe Token: SeBackupPrivilege 500 svchost.exe Token: SeRestorePrivilege 500 svchost.exe Token: SeIncreaseQuotaPrivilege 500 svchost.exe Token: SeAssignPrimaryTokenPrivilege 500 svchost.exe Token: SeImpersonatePrivilege 500 svchost.exe Token: SeTcbPrivilege 500 svchost.exe Token: SeChangeNotifyPrivilege 500 svchost.exe Token: SeCreateTokenPrivilege 500 svchost.exe Token: SeBackupPrivilege 500 svchost.exe Token: SeRestorePrivilege 500 svchost.exe Token: SeIncreaseQuotaPrivilege 500 svchost.exe Token: SeAssignPrimaryTokenPrivilege 500 svchost.exe Token: SeImpersonatePrivilege 500 svchost.exe Token: SeTcbPrivilege 500 svchost.exe Token: SeChangeNotifyPrivilege 500 svchost.exe Token: SeCreateTokenPrivilege 500 svchost.exe Token: SeBackupPrivilege 500 svchost.exe Token: SeRestorePrivilege 500 svchost.exe Token: SeIncreaseQuotaPrivilege 500 svchost.exe Token: SeAssignPrimaryTokenPrivilege 500 svchost.exe Token: SeImpersonatePrivilege 3764 svchost.exe Token: SeTcbPrivilege 3764 svchost.exe Token: SeChangeNotifyPrivilege 3764 svchost.exe Token: SeCreateTokenPrivilege 3764 svchost.exe Token: SeBackupPrivilege 3764 svchost.exe Token: SeRestorePrivilege 3764 svchost.exe Token: SeIncreaseQuotaPrivilege 3764 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3764 svchost.exe Token: SeImpersonatePrivilege 3764 svchost.exe Token: SeTcbPrivilege 3764 svchost.exe Token: SeChangeNotifyPrivilege 3764 svchost.exe Token: SeCreateTokenPrivilege 3764 svchost.exe Token: SeBackupPrivilege 3764 svchost.exe Token: SeRestorePrivilege 3764 svchost.exe Token: SeIncreaseQuotaPrivilege 3764 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3764 svchost.exe Token: SeImpersonatePrivilege 3764 svchost.exe Token: SeTcbPrivilege 3764 svchost.exe Token: SeChangeNotifyPrivilege 3764 svchost.exe Token: SeCreateTokenPrivilege 3764 svchost.exe Token: SeBackupPrivilege 3764 svchost.exe Token: SeRestorePrivilege 3764 svchost.exe Token: SeIncreaseQuotaPrivilege 3764 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3764 svchost.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE 3216 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3216 wrote to memory of 3872 3216 EXCEL.EXE 73 PID 3216 wrote to memory of 3872 3216 EXCEL.EXE 73 PID 3872 wrote to memory of 2520 3872 regsvr32.exe 74 PID 3872 wrote to memory of 2520 3872 regsvr32.exe 74 PID 3872 wrote to memory of 2520 3872 regsvr32.exe 74 PID 2520 wrote to memory of 500 2520 regsvr32.exe 76 PID 2520 wrote to memory of 500 2520 regsvr32.exe 76 PID 2520 wrote to memory of 500 2520 regsvr32.exe 76 PID 2520 wrote to memory of 500 2520 regsvr32.exe 76 PID 2520 wrote to memory of 500 2520 regsvr32.exe 76 PID 500 wrote to memory of 1076 500 svchost.exe 79 PID 500 wrote to memory of 1076 500 svchost.exe 79 PID 500 wrote to memory of 1076 500 svchost.exe 79 PID 500 wrote to memory of 3764 500 svchost.exe 81 PID 500 wrote to memory of 3764 500 svchost.exe 81 PID 500 wrote to memory of 3764 500 svchost.exe 81 PID 500 wrote to memory of 3764 500 svchost.exe 81 PID 500 wrote to memory of 3764 500 svchost.exe 81
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\offer_05634.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /i C:\ProgramData\dwrgMVW.ocx2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\regsvr32.exe/s /i C:\ProgramData\dwrgMVW.ocx3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\SysWOW64\cmd.execmd /K5⤵PID:1076
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 6884⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
-