Analysis

  • max time kernel
    109s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-07-2021 13:44

General

  • Target

    0722_4617368714.xls

  • Size

    343KB

  • MD5

    b9b909ba415fd197adabd75170b9c7f8

  • SHA1

    6ecf8ad51b9819fa60c7bf8926f3b0619d7add99

  • SHA256

    5fb78700e3391da56aba59107389499a0efb5fb2057e11398e1129b3a118a633

  • SHA512

    d666edc3afafc5d17e890cb9ddffbb1bea8e627eff896b93aefdf013e0f878db364dd9889629ef0c1f66b608ca0c6c4cf8811efa3ecbcb0e4a3d4a3c61e48116

Malware Config

Extracted

Family

hancitor

Botnet

2207_xwpi67

C2

http://tholeferli.com/8/forum.php

http://aidgodown.ru/8/forum.php

http://relifleappin.ru/8/forum.php

Signatures

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0722_4617368714.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3760
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\System32\svchost.exe
          4⤵
            PID:3848

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3628-118-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-121-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-122-0x00007FFAA9D30000-0x00007FFAAAE1E000-memory.dmp

      Filesize

      16.9MB

    • memory/3628-123-0x0000028B0B140000-0x0000028B0D035000-memory.dmp

      Filesize

      31.0MB

    • memory/3628-327-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-117-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-114-0x00007FF7B0880000-0x00007FF7B3E36000-memory.dmp

      Filesize

      53.7MB

    • memory/3628-116-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-115-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-330-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-329-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3628-328-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

      Filesize

      64KB

    • memory/3760-295-0x00000000031E0000-0x00000000031E1000-memory.dmp

      Filesize

      4KB

    • memory/3760-294-0x0000000004DA1000-0x0000000004DB9000-memory.dmp

      Filesize

      96KB

    • memory/3760-293-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

      Filesize

      40KB

    • memory/3760-292-0x0000000004DA0000-0x0000000004E66000-memory.dmp

      Filesize

      792KB