hancitor | 13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee

General

Target

13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee.vbs
Size

579KB
MD5

d4bfbd62db6574ae4a90a0c2a9fd8427
SHA1

cc7c9ca8679b2efe00d18048b8a0beadc2d53cc9
SHA256

13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee
SHA512

f8cfc582aad8e09685538e1059d1e4ce154043e12ae477b809391ebaac777bc38eda82b6e4e1c282808702ef80f128d17714d4c43510653fd0929529ed1ce009

Score

10^/10

hancitor 1212_78342432 downloader

Malware Config

Extracted

Family

hancitor

Botnet

1212_78342432

C2

http://vistiver.com/4/forum.php

http://thimemple.ru/4/forum.php

http://capandotd.ru/4/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1788	regsvr32.exe	27

Loads dropped DLL 1 IoCs

pid	Process
1352	regsvr32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 564	1352	regsvr32.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
564	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
784	WScript.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1352	1956	regsvr32.exe	29
PID 1956 wrote to memory of 1352	1956	regsvr32.exe	29
PID 1956 wrote to memory of 1352	1956	regsvr32.exe	29
PID 1956 wrote to memory of 1352	1956	regsvr32.exe	29
PID 1956 wrote to memory of 1352	1956	regsvr32.exe	29
PID 1956 wrote to memory of 1352	1956	regsvr32.exe	29
PID 1956 wrote to memory of 1352	1956	regsvr32.exe	29
PID 1352 wrote to memory of 564	1352	regsvr32.exe	30
PID 1352 wrote to memory of 564	1352	regsvr32.exe	30
PID 1352 wrote to memory of 564	1352	regsvr32.exe	30
PID 1352 wrote to memory of 564	1352	regsvr32.exe	30
PID 1352 wrote to memory of 564	1352	regsvr32.exe	30
PID 1352 wrote to memory of 564	1352	regsvr32.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee.vbs"
1⤵
- Suspicious use of FindShellTrayWindow
PID:784

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\regsvr32.exe
  -s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\htHvf.txt

Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit
\Users\Admin\AppData\Local\Temp\htHvf.txt

Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit
memory/564-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/564-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/564-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/564-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/564-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1352-57-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1352-60-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1352-67-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1352-59-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/1956-54-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing