hancitor | e4d6561ef40ae9c9e4343fb6184523a2f1fd90653245bd9ed017c858d49fc6c3

General

Target

in_6.xls
Size

90KB
MD5

d72515d8b2eecab727781df270c548b3
SHA1

1578bed7a4a4c4d61f8c1fc003b0d26feaf56e09
SHA256

e4d6561ef40ae9c9e4343fb6184523a2f1fd90653245bd9ed017c858d49fc6c3
SHA512

66a790306116ce388685568063287dd663639f9d4adc06e668ea45f6e29810c6e35c7ad5beeafd7cf6b82e5e89c6e42f8c427b3eb8951637bc5ae2153d4590bc

Score

10^/10

hancitor pony 1307_qsew downloader rat spyware stealer

Malware Config

Extracted

Family

hancitor

Botnet

1307_qsew

C2

http://overnightfile.com/4/forum.php

http://toolboxkasa.ru/4/forum.php

http://ibexjade.ru/4/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1360	1296	regsvr32.exe	EXCEL.EXE

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1764 regsvr32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org

pid	process
1764	regsvr32.exe

flow	ioc
6	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

Processes:

regsvr32.exesvchost.exe

description	pid	process	target process
PID 1764 set thread context of 1816	1764	regsvr32.exe	svchost.exe
PID 1816 set thread context of 800	1816	svchost.exe	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1296 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

svchost.exe

pid process

1816 svchost.exe
1816 svchost.exe
1816 svchost.exe

pid	process
1296	EXCEL.EXE

pid	process
1816	svchost.exe
1816	svchost.exe
1816	svchost.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeImpersonatePrivilege	1816	svchost.exe
Token: SeTcbPrivilege	1816	svchost.exe
Token: SeChangeNotifyPrivilege	1816	svchost.exe
Token: SeCreateTokenPrivilege	1816	svchost.exe
Token: SeBackupPrivilege	1816	svchost.exe
Token: SeRestorePrivilege	1816	svchost.exe
Token: SeIncreaseQuotaPrivilege	1816	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1816	svchost.exe
Token: SeImpersonatePrivilege	1816	svchost.exe
Token: SeTcbPrivilege	1816	svchost.exe
Token: SeChangeNotifyPrivilege	1816	svchost.exe
Token: SeCreateTokenPrivilege	1816	svchost.exe
Token: SeBackupPrivilege	1816	svchost.exe
Token: SeRestorePrivilege	1816	svchost.exe
Token: SeIncreaseQuotaPrivilege	1816	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1816	svchost.exe
Token: SeImpersonatePrivilege	1816	svchost.exe
Token: SeTcbPrivilege	1816	svchost.exe
Token: SeChangeNotifyPrivilege	1816	svchost.exe
Token: SeCreateTokenPrivilege	1816	svchost.exe
Token: SeBackupPrivilege	1816	svchost.exe
Token: SeRestorePrivilege	1816	svchost.exe
Token: SeIncreaseQuotaPrivilege	1816	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1816	svchost.exe
Token: SeImpersonatePrivilege	1816	svchost.exe
Token: SeTcbPrivilege	1816	svchost.exe
Token: SeChangeNotifyPrivilege	1816	svchost.exe
Token: SeCreateTokenPrivilege	1816	svchost.exe
Token: SeBackupPrivilege	1816	svchost.exe
Token: SeRestorePrivilege	1816	svchost.exe
Token: SeIncreaseQuotaPrivilege	1816	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1816	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1296 EXCEL.EXE
1296 EXCEL.EXE
1296 EXCEL.EXE

pid	process
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

EXCEL.EXEregsvr32.exeregsvr32.exesvchost.exe

description	pid	process	target process
PID 1296 wrote to memory of 1360	1296	EXCEL.EXE	regsvr32.exe
PID 1296 wrote to memory of 1360	1296	EXCEL.EXE	regsvr32.exe
PID 1296 wrote to memory of 1360	1296	EXCEL.EXE	regsvr32.exe
PID 1296 wrote to memory of 1360	1296	EXCEL.EXE	regsvr32.exe
PID 1296 wrote to memory of 1360	1296	EXCEL.EXE	regsvr32.exe
PID 1360 wrote to memory of 1764	1360	regsvr32.exe	regsvr32.exe
PID 1360 wrote to memory of 1764	1360	regsvr32.exe	regsvr32.exe
PID 1360 wrote to memory of 1764	1360	regsvr32.exe	regsvr32.exe
PID 1360 wrote to memory of 1764	1360	regsvr32.exe	regsvr32.exe
PID 1360 wrote to memory of 1764	1360	regsvr32.exe	regsvr32.exe
PID 1360 wrote to memory of 1764	1360	regsvr32.exe	regsvr32.exe
PID 1360 wrote to memory of 1764	1360	regsvr32.exe	regsvr32.exe
PID 1764 wrote to memory of 1816	1764	regsvr32.exe	svchost.exe
PID 1764 wrote to memory of 1816	1764	regsvr32.exe	svchost.exe
PID 1764 wrote to memory of 1816	1764	regsvr32.exe	svchost.exe
PID 1764 wrote to memory of 1816	1764	regsvr32.exe	svchost.exe
PID 1764 wrote to memory of 1816	1764	regsvr32.exe	svchost.exe
PID 1764 wrote to memory of 1816	1764	regsvr32.exe	svchost.exe
PID 1816 wrote to memory of 1872	1816	svchost.exe	cmd.exe
PID 1816 wrote to memory of 1872	1816	svchost.exe	cmd.exe
PID 1816 wrote to memory of 1872	1816	svchost.exe	cmd.exe
PID 1816 wrote to memory of 1872	1816	svchost.exe	cmd.exe
PID 1816 wrote to memory of 800	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 800	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 800	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 800	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 800	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 800	1816	svchost.exe	svchost.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\in_6.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /i BvkFvmz.ocx
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\regsvr32.exe
/s /i BvkFvmz.ocx
3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd /K
5⤵
PID:1872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
5⤵
PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\BvkFvmz.ocx
MD5
56921bed6e4dd3ba4064557d453e403e

SHA1
9a2ec0abbde02b61d56990882ea6c43d833114b3

SHA256
a1ea6e27f13d729c388d0cf8a22f07407bf52290d0b68f4d4da1637d3a2b8eea

SHA512
d27da6d2386185d1ea76a195bee2d72e1ac229b841f4b60eafe0e4055cbaaaeecd99e1d9f0693eab660fa480baa74a00ad9a0ca43b392a83d285ddea4bf8911c

Download Submit
\Users\Admin\Documents\BvkFvmz.ocx
MD5
56921bed6e4dd3ba4064557d453e403e

SHA1
9a2ec0abbde02b61d56990882ea6c43d833114b3

SHA256
a1ea6e27f13d729c388d0cf8a22f07407bf52290d0b68f4d4da1637d3a2b8eea

SHA512
d27da6d2386185d1ea76a195bee2d72e1ac229b841f4b60eafe0e4055cbaaaeecd99e1d9f0693eab660fa480baa74a00ad9a0ca43b392a83d285ddea4bf8911c

Download Submit
memory/800-11-0x000000000BC00000-0x000000000BC12000-memory.dmp

Filesize
72KB

Download
memory/800-12-0x000000000BC01067-mapping.dmp

Download
memory/800-13-0x000000000BC00000-0x000000000BC12000-memory.dmp

Filesize
72KB

Download
memory/1360-0-0x0000000000000000-mapping.dmp

Download
memory/1764-2-0x0000000000000000-mapping.dmp

Download
memory/1816-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1816-5-0x0000000000402960-mapping.dmp

Download
memory/1816-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1872-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads