hancitor | 47827631f799254cd0e98c16cdf7af77cd303b4a574f761ed3f9a51bfda30a91

General

Target

_2866571907494.vbs
Size

579KB
MD5

d4bfbd62db6574ae4a90a0c2a9fd8427
SHA1

cc7c9ca8679b2efe00d18048b8a0beadc2d53cc9
SHA256

13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee
SHA512

f8cfc582aad8e09685538e1059d1e4ce154043e12ae477b809391ebaac777bc38eda82b6e4e1c282808702ef80f128d17714d4c43510653fd0929529ed1ce009

Score

10^/10

hancitor 1212_78342432 downloader

Malware Config

Extracted

Family

hancitor

Botnet

1212_78342432

C2

http://vistiver.com/4/forum.php

http://thimemple.ru/4/forum.php

http://capandotd.ru/4/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4252 4992 regsvr32.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4228 regsvr32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 4228 set thread context of 3024 4228 regsvr32.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

svchost.exe

pid process

3024 svchost.exe
3024 svchost.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

WScript.exe

pid process

1364 WScript.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	4992	regsvr32.exe

pid	process
4228	regsvr32.exe

flow	ioc
3	api.ipify.org

description	pid	process	target process
PID 4228 set thread context of 3024	4228	regsvr32.exe	svchost.exe

pid	process
3024	svchost.exe
3024	svchost.exe

pid	process
1364	WScript.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4252 wrote to memory of 4228	4252	regsvr32.exe	regsvr32.exe
PID 4252 wrote to memory of 4228	4252	regsvr32.exe	regsvr32.exe
PID 4252 wrote to memory of 4228	4252	regsvr32.exe	regsvr32.exe
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	svchost.exe
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	svchost.exe
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	svchost.exe
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	svchost.exe
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	svchost.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_2866571907494.vbs"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1364

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\SysWOW64\regsvr32.exe
-s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\htHvf.txt
Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit
C:\Users\Admin\AppData\Local\Temp\htHvf.txt
Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit
memory/3024-134-0x0000000000000000-mapping.dmp

Download
memory/3024-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4228-131-0x0000000000000000-mapping.dmp

Download
memory/4228-133-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/4228-138-0x00000000020A0000-0x00000000020AC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing