hancitor | 47827631f799254cd0e98c16cdf7af77cd303b4a574f761ed3f9a51bfda30a91

General

Target

_2866571907494.vbs
Size

579KB
MD5

d4bfbd62db6574ae4a90a0c2a9fd8427
SHA1

cc7c9ca8679b2efe00d18048b8a0beadc2d53cc9
SHA256

13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee
SHA512

f8cfc582aad8e09685538e1059d1e4ce154043e12ae477b809391ebaac777bc38eda82b6e4e1c282808702ef80f128d17714d4c43510653fd0929529ed1ce009

Score

10^/10

hancitor 1212_78342432 downloader

Malware Config

Extracted

Family

hancitor

Botnet

1212_78342432

C2

http://vistiver.com/4/forum.php

http://thimemple.ru/4/forum.php

http://capandotd.ru/4/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	4992	regsvr32.exe	35

Loads dropped DLL 1 IoCs

pid	Process
4228	regsvr32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 3024	4228	regsvr32.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3024	svchost.exe
3024	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1364	WScript.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4228	4252	regsvr32.exe	80
PID 4252 wrote to memory of 4228	4252	regsvr32.exe	80
PID 4252 wrote to memory of 4228	4252	regsvr32.exe	80
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	81
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	81
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	81
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	81
PID 4228 wrote to memory of 3024	4228	regsvr32.exe	81

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_2866571907494.vbs"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1364

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\regsvr32.exe
  -s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\htHvf.txt

Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit
C:\Users\Admin\AppData\Local\Temp\htHvf.txt

Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit
memory/3024-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4228-133-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/4228-138-0x00000000020A0000-0x00000000020AC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing