hancitor | 1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

General

Target

1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
Size

446KB
MD5

5d9d7915ae733016e1bc3fed44ac951a
SHA1

2e47a92c311665629e2a7de03a0094548a56511a
SHA256

1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed
SHA512

015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

Score

10^/10

hancitor 1310_wing downloader persistence

Malware Config

Extracted

Family

hancitor

Botnet

1310_wing

C2

http://phercopar.com/4/forum.php

http://sjogetahit.ru/4/forum.php

http://netodughra.ru/4/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Executes dropped EXE 1 IoCs

pid	Process
2900	WinHost32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinHost32 = "C:\\Windows\\System32\\WinHost32.exe"	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinHost32.exe	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
2900	WinHost32.exe
2900	WinHost32.exe
2900	WinHost32.exe
2900	WinHost32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2900	1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	82
PID 1960 wrote to memory of 2900	1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	82
PID 1960 wrote to memory of 2900	1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	82
PID 1960 wrote to memory of 2948	1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	83
PID 1960 wrote to memory of 2948	1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	83
PID 1960 wrote to memory of 2948	1960	1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe	83

C:\Users\Admin\AppData\Local\Temp\1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe
"C:\Users\Admin\AppData\Local\Temp\1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WinHost32.exe
  C:\Windows\System32\WinHost32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  /c del C:\Users\Admin\AppData\Local\Temp\1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed.exe >> NUL
  2⤵
  PID:2948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WinHost32.exe

Filesize
446KB

MD5
5d9d7915ae733016e1bc3fed44ac951a

SHA1
2e47a92c311665629e2a7de03a0094548a56511a

SHA256
1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

SHA512
015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

Download Submit
C:\Windows\SysWOW64\WinHost32.exe

Filesize
446KB

MD5
5d9d7915ae733016e1bc3fed44ac951a

SHA1
2e47a92c311665629e2a7de03a0094548a56511a

SHA256
1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

SHA512
015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

Download Submit
memory/1960-134-0x00000000005C0000-0x00000000005E5000-memory.dmp

Filesize
148KB

Download
memory/1960-135-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2900-136-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing