hancitor | f4427ef6b665bf0563f23fde314caf9f905ab1e049fc5c0b33384d526ec3cbf1

General

Target

han.exe
Size

500KB
MD5

e8a8c90d7da67da7ee790e9e49127cf7
SHA1

65731d02a9a9899b1ee72e822d3dab2129fffa9a
SHA256

f4427ef6b665bf0563f23fde314caf9f905ab1e049fc5c0b33384d526ec3cbf1
SHA512

aa0c0cb8aa0d6864da79cee8e14c3dd70d320d42ca19b999be34a243416011aea3fb9b02a10b860234dde7abfaef6ef4fca704233258beb1b182fb0c043fb9a3

Score

10^/10

hancitor downloader persistence

Malware Config

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Executes dropped EXE 1 IoCs

Processes:

WinHost32.exe

pid process

1980 WinHost32.exe

pid	process
1980	WinHost32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

han.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinHost32 = "C:\\Windows\\System32\\WinHost32.exe"	han.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 api.ipify.org
Drops file in System32 directory 1 IoCs

Processes:

han.exe

description ioc process

File created C:\Windows\SysWOW64\WinHost32.exe han.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

han.exeWinHost32.exe

pid process

584 han.exe
584 han.exe
1980 WinHost32.exe
1980 WinHost32.exe
1980 WinHost32.exe
1980 WinHost32.exe

flow	ioc
13	api.ipify.org

description	ioc	process
File created	C:\Windows\SysWOW64\WinHost32.exe	han.exe

pid	process
584	han.exe
584	han.exe
1980	WinHost32.exe
1980	WinHost32.exe
1980	WinHost32.exe
1980	WinHost32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

han.exe

description	pid	process	target process
PID 584 wrote to memory of 1980	584	han.exe	WinHost32.exe
PID 584 wrote to memory of 1980	584	han.exe	WinHost32.exe
PID 584 wrote to memory of 1980	584	han.exe	WinHost32.exe
PID 584 wrote to memory of 3132	584	han.exe	cmd.exe
PID 584 wrote to memory of 3132	584	han.exe	cmd.exe
PID 584 wrote to memory of 3132	584	han.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\han.exe
"C:\Users\Admin\AppData\Local\Temp\han.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SysWOW64\WinHost32.exe
  C:\Windows\System32\WinHost32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Windows\SysWOW64\cmd.exe
  /c del C:\Users\Admin\AppData\Local\Temp\han.exe >> NUL
  2⤵
  PID:3132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WinHost32.exe

MD5
e8a8c90d7da67da7ee790e9e49127cf7

SHA1
65731d02a9a9899b1ee72e822d3dab2129fffa9a

SHA256
f4427ef6b665bf0563f23fde314caf9f905ab1e049fc5c0b33384d526ec3cbf1

SHA512
aa0c0cb8aa0d6864da79cee8e14c3dd70d320d42ca19b999be34a243416011aea3fb9b02a10b860234dde7abfaef6ef4fca704233258beb1b182fb0c043fb9a3

Download Submit
C:\Windows\SysWOW64\WinHost32.exe

MD5
e8a8c90d7da67da7ee790e9e49127cf7

SHA1
65731d02a9a9899b1ee72e822d3dab2129fffa9a

SHA256
f4427ef6b665bf0563f23fde314caf9f905ab1e049fc5c0b33384d526ec3cbf1

SHA512
aa0c0cb8aa0d6864da79cee8e14c3dd70d320d42ca19b999be34a243416011aea3fb9b02a10b860234dde7abfaef6ef4fca704233258beb1b182fb0c043fb9a3

Download Submit
memory/1980-0-0x0000000000000000-mapping.dmp

Download
memory/3132-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing