Overview

overview

10

Static

static

8

0817_3885680415.doc

windows7_x64

4

0817_3885680415.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0817_3885680415.doc

  • Size

    837KB

  • Sample

    210817-pl4bd14ba6

  • MD5

    0753f1dd26d5baf0b87d7a814937a8c2

  • SHA1

    7f2baabc3d8bd68a59cad677345219f1fcaa00de

  • SHA256

    99b6ae648c779e65aacd21d02be4e64bb2ad894690a03cd89515b100c1273a70

  • SHA512

    271c1720a7ff2301e338dcc728310dfa438083118cc26dc24d00246232b493a42d5a17ba254767289801a359de4998aa1f758a4d445af00371a9211f7c1c4fb4

Score
10/10
hancitor1608_febddownloadermacromacro_on_action

Malware Config

Extracted

Family

hancitor

Botnet

1608_febd

C2

http://patiennerrhe.com/8/forum.php

http://thougolograrly.ru/8/forum.php

http://chopprousite.ru/8/forum.php

Targets

    • Target

      0817_3885680415.doc

    • Size

      837KB

    • MD5

      0753f1dd26d5baf0b87d7a814937a8c2

    • SHA1

      7f2baabc3d8bd68a59cad677345219f1fcaa00de

    • SHA256

      99b6ae648c779e65aacd21d02be4e64bb2ad894690a03cd89515b100c1273a70

    • SHA512

      271c1720a7ff2301e338dcc728310dfa438083118cc26dc24d00246232b493a42d5a17ba254767289801a359de4998aa1f758a4d445af00371a9211f7c1c4fb4

    Score
    10/10
    hancitor1608_febddownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks