Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25/02/2021, 16:45

General

  • Target

    https://buahpinggang.my/emptiness.php

  • Sample

    210225-qx3jez1426

Malware Config

Extracted

Family

hancitor

Botnet

2502_ser3402

C2

http://speritentz.com/8/forum.php

http://afternearde.ru/8/forum.php

http://counivicop.ru/8/forum.php

Signatures

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://buahpinggang.my/emptiness.php
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://buahpinggang.my/emptiness.php
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.0.332011879\1696152514" -parentBuildID 20200403170909 -prefsHandle 1528 -prefMapHandle 1508 -prefsLen 1 -prefMapSize 219511 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 1612 gpu
        3⤵
          PID:720
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.3.1045707550\1238288905" -childID 1 -isForBrowser -prefsHandle 2196 -prefMapHandle 2192 -prefsLen 156 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 2204 tab
          3⤵
            PID:4208
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.13.1368259339\1524521623" -childID 2 -isForBrowser -prefsHandle 3188 -prefMapHandle 3184 -prefsLen 7013 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 3236 tab
            3⤵
              PID:908
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.20.1919350552\1239770975" -childID 3 -isForBrowser -prefsHandle 4236 -prefMapHandle 4256 -prefsLen 8126 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4288 tab
              3⤵
                PID:4504
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.27.64113736\449692072" -childID 4 -isForBrowser -prefsHandle 3532 -prefMapHandle 3528 -prefsLen 8437 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 8700 tab
                3⤵
                  PID:3264
            • C:\Windows\system32\AUDIODG.EXE
              C:\Windows\system32\AUDIODG.EXE 0x3c4
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3948
            • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
              "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\0225_27840852049042.doc" /o ""
              1⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • NTFS ADS
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:1744
              • C:\Windows\splwow64.exe
                C:\Windows\splwow64.exe 12288
                2⤵
                  PID:4308
                • C:\Windows\System32\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\word\startup\Static.dll,PVAXQXJSHTN
                  2⤵
                  • Process spawned unexpected child process
                  PID:4648
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\word\startup\Static.dll,PVAXQXJSHTN
                    3⤵
                    • Blocklisted process makes network request
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2748
                    • C:\Windows\SysWOW64\svchost.exe
                      C:\Windows\System32\svchost.exe
                      4⤵
                        PID:988

                Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1744-23-0x00007FF934190000-0x00007FF936CB3000-memory.dmp

                        Filesize

                        43.1MB

                      • memory/1744-26-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/1744-9-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/1744-10-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/1744-11-0x00007FF932A00000-0x00007FF933037000-memory.dmp

                        Filesize

                        6.2MB

                      • memory/1744-12-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/1744-8-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/1744-22-0x00007FF934190000-0x00007FF936CB3000-memory.dmp

                        Filesize

                        43.1MB

                      • memory/1744-21-0x00007FF934190000-0x00007FF936CB3000-memory.dmp

                        Filesize

                        43.1MB

                      • memory/1744-27-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/1744-24-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/1744-20-0x00007FF934190000-0x00007FF936CB3000-memory.dmp

                        Filesize

                        43.1MB

                      • memory/1744-25-0x00007FF91BD80000-0x00007FF91BD90000-memory.dmp

                        Filesize

                        64KB

                      • memory/2748-28-0x00000000736C0000-0x00000000736CA000-memory.dmp

                        Filesize

                        40KB

                      • memory/2748-29-0x0000000000D50000-0x0000000000D51000-memory.dmp

                        Filesize

                        4KB

                      • memory/4308-15-0x0000000002870000-0x0000000002971000-memory.dmp

                        Filesize

                        1.0MB