hancitor | 1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

General

Target

1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
Size

446KB
MD5

5d9d7915ae733016e1bc3fed44ac951a
SHA1

2e47a92c311665629e2a7de03a0094548a56511a
SHA256

1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed
SHA512

015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

Score

10^/10

hancitor 1310_wing downloader persistence

Malware Config

Extracted

Family

hancitor

Botnet

1310_wing

C2

http://phercopar.com/4/forum.php

http://sjogetahit.ru/4/forum.php

http://netodughra.ru/4/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Executes dropped EXE 1 IoCs

pid	Process
1616	WinHost32.exe

Deletes itself 1 IoCs

pid	Process
1632	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinHost32 = "C:\\Windows\\System32\\WinHost32.exe"	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinHost32.exe	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
1616	WinHost32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1616	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	28
PID 1420 wrote to memory of 1616	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	28
PID 1420 wrote to memory of 1616	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	28
PID 1420 wrote to memory of 1616	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	28
PID 1420 wrote to memory of 1632	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	29
PID 1420 wrote to memory of 1632	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	29
PID 1420 wrote to memory of 1632	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	29
PID 1420 wrote to memory of 1632	1420	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	29

C:\Users\Admin\AppData\Local\Temp\1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
"C:\Users\Admin\AppData\Local\Temp\1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WinHost32.exe
  C:\Windows\System32\WinHost32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1616
- C:\Windows\SysWOW64\cmd.exe
  /c del C:\Users\Admin\AppData\Local\Temp\1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe >> NUL
  2⤵
  - Deletes itself
  PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WinHost32.exe

Filesize
446KB

MD5
5d9d7915ae733016e1bc3fed44ac951a

SHA1
2e47a92c311665629e2a7de03a0094548a56511a

SHA256
1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

SHA512
015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

Download Submit
\Windows\SysWOW64\WinHost32.exe

Filesize
446KB

MD5
5d9d7915ae733016e1bc3fed44ac951a

SHA1
2e47a92c311665629e2a7de03a0094548a56511a

SHA256
1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

SHA512
015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

Download Submit
\Windows\SysWOW64\WinHost32.exe

Filesize
446KB

MD5
5d9d7915ae733016e1bc3fed44ac951a

SHA1
2e47a92c311665629e2a7de03a0094548a56511a

SHA256
1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

SHA512
015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

Download Submit
memory/1420-54-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/1420-55-0x0000000000250000-0x0000000000275000-memory.dmp

Filesize
148KB

Download
memory/1420-56-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1616-63-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing