Analysis
-
max time kernel
151s -
max time network
119s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
15-07-2020 22:55
Behavioral task
behavioral1
Sample
in_6.xls
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
in_6.xls
-
Size
90KB
-
MD5
d72515d8b2eecab727781df270c548b3
-
SHA1
1578bed7a4a4c4d61f8c1fc003b0d26feaf56e09
-
SHA256
e4d6561ef40ae9c9e4343fb6184523a2f1fd90653245bd9ed017c858d49fc6c3
-
SHA512
66a790306116ce388685568063287dd663639f9d4adc06e668ea45f6e29810c6e35c7ad5beeafd7cf6b82e5e89c6e42f8c427b3eb8951637bc5ae2153d4590bc
Malware Config
Extracted
Family
hancitor
Botnet
1307_qsew
C2
http://overnightfile.com/4/forum.php
http://toolboxkasa.ru/4/forum.php
http://ibexjade.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1360 1296 regsvr32.exe 23 -
Loads dropped DLL 1 IoCs
pid Process 1764 regsvr32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1764 set thread context of 1816 1764 regsvr32.exe 29 PID 1816 set thread context of 800 1816 svchost.exe 35 -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1296 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1816 svchost.exe 1816 svchost.exe 1816 svchost.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1816 svchost.exe Token: SeTcbPrivilege 1816 svchost.exe Token: SeChangeNotifyPrivilege 1816 svchost.exe Token: SeCreateTokenPrivilege 1816 svchost.exe Token: SeBackupPrivilege 1816 svchost.exe Token: SeRestorePrivilege 1816 svchost.exe Token: SeIncreaseQuotaPrivilege 1816 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1816 svchost.exe Token: SeImpersonatePrivilege 1816 svchost.exe Token: SeTcbPrivilege 1816 svchost.exe Token: SeChangeNotifyPrivilege 1816 svchost.exe Token: SeCreateTokenPrivilege 1816 svchost.exe Token: SeBackupPrivilege 1816 svchost.exe Token: SeRestorePrivilege 1816 svchost.exe Token: SeIncreaseQuotaPrivilege 1816 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1816 svchost.exe Token: SeImpersonatePrivilege 1816 svchost.exe Token: SeTcbPrivilege 1816 svchost.exe Token: SeChangeNotifyPrivilege 1816 svchost.exe Token: SeCreateTokenPrivilege 1816 svchost.exe Token: SeBackupPrivilege 1816 svchost.exe Token: SeRestorePrivilege 1816 svchost.exe Token: SeIncreaseQuotaPrivilege 1816 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1816 svchost.exe Token: SeImpersonatePrivilege 1816 svchost.exe Token: SeTcbPrivilege 1816 svchost.exe Token: SeChangeNotifyPrivilege 1816 svchost.exe Token: SeCreateTokenPrivilege 1816 svchost.exe Token: SeBackupPrivilege 1816 svchost.exe Token: SeRestorePrivilege 1816 svchost.exe Token: SeIncreaseQuotaPrivilege 1816 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1816 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1296 EXCEL.EXE 1296 EXCEL.EXE 1296 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1296 wrote to memory of 1360 1296 EXCEL.EXE 26 PID 1296 wrote to memory of 1360 1296 EXCEL.EXE 26 PID 1296 wrote to memory of 1360 1296 EXCEL.EXE 26 PID 1296 wrote to memory of 1360 1296 EXCEL.EXE 26 PID 1296 wrote to memory of 1360 1296 EXCEL.EXE 26 PID 1360 wrote to memory of 1764 1360 regsvr32.exe 27 PID 1360 wrote to memory of 1764 1360 regsvr32.exe 27 PID 1360 wrote to memory of 1764 1360 regsvr32.exe 27 PID 1360 wrote to memory of 1764 1360 regsvr32.exe 27 PID 1360 wrote to memory of 1764 1360 regsvr32.exe 27 PID 1360 wrote to memory of 1764 1360 regsvr32.exe 27 PID 1360 wrote to memory of 1764 1360 regsvr32.exe 27 PID 1764 wrote to memory of 1816 1764 regsvr32.exe 29 PID 1764 wrote to memory of 1816 1764 regsvr32.exe 29 PID 1764 wrote to memory of 1816 1764 regsvr32.exe 29 PID 1764 wrote to memory of 1816 1764 regsvr32.exe 29 PID 1764 wrote to memory of 1816 1764 regsvr32.exe 29 PID 1764 wrote to memory of 1816 1764 regsvr32.exe 29 PID 1816 wrote to memory of 1872 1816 svchost.exe 33 PID 1816 wrote to memory of 1872 1816 svchost.exe 33 PID 1816 wrote to memory of 1872 1816 svchost.exe 33 PID 1816 wrote to memory of 1872 1816 svchost.exe 33 PID 1816 wrote to memory of 800 1816 svchost.exe 35 PID 1816 wrote to memory of 800 1816 svchost.exe 35 PID 1816 wrote to memory of 800 1816 svchost.exe 35 PID 1816 wrote to memory of 800 1816 svchost.exe 35 PID 1816 wrote to memory of 800 1816 svchost.exe 35 PID 1816 wrote to memory of 800 1816 svchost.exe 35
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\in_6.xls1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /i BvkFvmz.ocx2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\regsvr32.exe/s /i BvkFvmz.ocx3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd /K5⤵PID:1872
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe5⤵PID:800
-
-
-
-