hancitor | a6bd19943dd9083e7a2f67c9302c32cbc5640d245d84176c43e9369cd6c34a11

General

Target

file.doc
Size

1.3MB
MD5

df1322214337bed7cc898bdca5002e8b
SHA1

dac91c99f1bb2b62ccd39e53ca6b2368efdb6c16
SHA256

a6bd19943dd9083e7a2f67c9302c32cbc5640d245d84176c43e9369cd6c34a11
SHA512

bb2814b3a11e24e245f58ddc9401473c98fb0f8168b792f37844e2a22e6faf7fed789088f53437c82e9ebbb35b55ceaec090e5fef8544a0617e059dc411b4e50

Score

10^/10

hancitor 2306_vensip downloader

Malware Config

Extracted

Family

hancitor

Botnet

2306_vensip

C2

http://extilivelly.com/8/forum.php

http://cludimetifte.ru/8/forum.php

http://sakincesed.ru/8/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1012	808	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

23 2272 rundll32.exe
31 2272 rundll32.exe
33 2272 rundll32.exe
38 2272 rundll32.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2272 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 api.ipify.org

flow	pid	process
23	2272	rundll32.exe
31	2272	rundll32.exe
33	2272	rundll32.exe
38	2272	rundll32.exe

pid	process
2272	rundll32.exe

flow	ioc
22	api.ipify.org

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

NTFS ADS 1 IoCs

Processes:

WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{31C190DE-801D-42F0-87E1-15EA8BA19DDA}\kiks.dll:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

808 WINWORD.EXE
808 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe

pid	process
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

WINWORD.EXE

pid	process
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE
808	WINWORD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WINWORD.EXErundll32.exerundll32.exe

description	pid	process	target process
PID 808 wrote to memory of 2256	808	WINWORD.EXE	splwow64.exe
PID 808 wrote to memory of 2256	808	WINWORD.EXE	splwow64.exe
PID 808 wrote to memory of 1012	808	WINWORD.EXE	rundll32.exe
PID 808 wrote to memory of 1012	808	WINWORD.EXE	rundll32.exe
PID 1012 wrote to memory of 2272	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 2272	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 2272	1012	rundll32.exe	rundll32.exe
PID 2272 wrote to memory of 3508	2272	rundll32.exe	svchost.exe
PID 2272 wrote to memory of 3508	2272	rundll32.exe	svchost.exe
PID 2272 wrote to memory of 3508	2272	rundll32.exe	svchost.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2256

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll,OFCBWXTHRNL
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll,OFCBWXTHRNL
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
4⤵
PID:3508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll
MD5
f61f9089197a75117560282aac7248d8

SHA1
eed6a442876e47bba03ad10d9c8b9598c6984f7f

SHA256
0416ef18d64e63ad9d711577310fa26345fad68df34c0def6978feaffc40ae1b

SHA512
70e54bb3a361fbcec7cd730c1142b29542877270cf90779755c8654b3d03b692f1abc4d7d29adef3dc4ad27fc521a5977b446aaf999194e7c43e5db860dd9713

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Templates\kikus.dll
MD5
f61f9089197a75117560282aac7248d8

SHA1
eed6a442876e47bba03ad10d9c8b9598c6984f7f

SHA256
0416ef18d64e63ad9d711577310fa26345fad68df34c0def6978feaffc40ae1b

SHA512
70e54bb3a361fbcec7cd730c1142b29542877270cf90779755c8654b3d03b692f1abc4d7d29adef3dc4ad27fc521a5977b446aaf999194e7c43e5db860dd9713

Download Submit
memory/808-122-0x00007FF9076D0000-0x00007FF9087BE000-memory.dmp

Filesize
16.9MB

Download
memory/808-117-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmp

Filesize
64KB

Download
memory/808-119-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmp

Filesize
64KB

Download
memory/808-118-0x00007FF90CD90000-0x00007FF90F8B3000-memory.dmp

Filesize
43.1MB

Download
memory/808-114-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmp

Filesize
64KB

Download
memory/808-123-0x00007FF9057D0000-0x00007FF9076C5000-memory.dmp

Filesize
31.0MB

Download
memory/808-116-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmp

Filesize
64KB

Download
memory/808-115-0x00007FF8EBA40000-0x00007FF8EBA50000-memory.dmp

Filesize
64KB

Download
memory/1012-180-0x0000000000000000-mapping.dmp

Download
memory/2256-179-0x0000000000000000-mapping.dmp

Download
memory/2272-182-0x0000000000000000-mapping.dmp

Download
memory/2272-184-0x0000000002CB0000-0x0000000002D5E000-memory.dmp

Filesize
696KB

Download
memory/2272-185-0x0000000002F10000-0x0000000002F33000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads