hancitor | ea578abc194c0cdd7cff923d0e935fe3cf462c70011cef72126a40ac632a18ac

General

Target

abfdc758c2f28a670d7474448d45dcac.doc
Size

1.3MB
MD5

abfdc758c2f28a670d7474448d45dcac
SHA1

0b18454885918bcda8403bd8a95ae6a04aa1f992
SHA256

ea578abc194c0cdd7cff923d0e935fe3cf462c70011cef72126a40ac632a18ac
SHA512

82402cafbd5f0443fdf68614feee830ba846cd0f7d46185ae68abc03e58155c8d0a0080e64ae6aa868d74865bff8bd9685fda6f6f957ae827d997a22d81086f0
SSDEEP

24576:fEIZ4wA74D4SQKxZcy8gthDWl/chYusVNVQK0U/p8C:f+wJD4QZh/qdKMn70up8

Score

10^/10

hancitor 2306_vensip downloader

Malware Config

Extracted

Family

hancitor

Botnet

2306_vensip

C2

http://extilivelly.com/8/forum.php

http://cludimetifte.ru/8/forum.php

http://sakincesed.ru/8/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	5104	5004	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

48 4908 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

4908 rundll32.exe
4908 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

47 api.ipify.org

flow	pid	process
48	4908	rundll32.exe

pid	process
4908	rundll32.exe
4908	rundll32.exe

flow	ioc
47	api.ipify.org

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

NTFS ADS 1 IoCs

Processes:

WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{50D7A933-AF33-4D2C-BC02-81665C63B4A7}\kiks.dll:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

5004 WINWORD.EXE
5004 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4908 rundll32.exe
4908 rundll32.exe

pid	process
4908	rundll32.exe
4908	rundll32.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

WINWORD.EXE

pid	process
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

WINWORD.EXErundll32.exe

description	pid	process	target process
PID 5004 wrote to memory of 1164	5004	WINWORD.EXE	splwow64.exe
PID 5004 wrote to memory of 1164	5004	WINWORD.EXE	splwow64.exe
PID 5004 wrote to memory of 5104	5004	WINWORD.EXE	rundll32.exe
PID 5004 wrote to memory of 5104	5004	WINWORD.EXE	rundll32.exe
PID 5104 wrote to memory of 4908	5104	rundll32.exe	rundll32.exe
PID 5104 wrote to memory of 4908	5104	rundll32.exe	rundll32.exe
PID 5104 wrote to memory of 4908	5104	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\abfdc758c2f28a670d7474448d45dcac.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1164

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll,OFCBWXTHRNL
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll,OFCBWXTHRNL
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\kikus.dll
Filesize
721KB

MD5
f61f9089197a75117560282aac7248d8

SHA1
eed6a442876e47bba03ad10d9c8b9598c6984f7f

SHA256
0416ef18d64e63ad9d711577310fa26345fad68df34c0def6978feaffc40ae1b

SHA512
70e54bb3a361fbcec7cd730c1142b29542877270cf90779755c8654b3d03b692f1abc4d7d29adef3dc4ad27fc521a5977b446aaf999194e7c43e5db860dd9713

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\kikus.dll
Filesize
721KB

MD5
f61f9089197a75117560282aac7248d8

SHA1
eed6a442876e47bba03ad10d9c8b9598c6984f7f

SHA256
0416ef18d64e63ad9d711577310fa26345fad68df34c0def6978feaffc40ae1b

SHA512
70e54bb3a361fbcec7cd730c1142b29542877270cf90779755c8654b3d03b692f1abc4d7d29adef3dc4ad27fc521a5977b446aaf999194e7c43e5db860dd9713

Download Submit
\??\c:\users\admin\appdata\roaming\microsoft\templates\kikus.dll
Filesize
721KB

MD5
f61f9089197a75117560282aac7248d8

SHA1
eed6a442876e47bba03ad10d9c8b9598c6984f7f

SHA256
0416ef18d64e63ad9d711577310fa26345fad68df34c0def6978feaffc40ae1b

SHA512
70e54bb3a361fbcec7cd730c1142b29542877270cf90779755c8654b3d03b692f1abc4d7d29adef3dc4ad27fc521a5977b446aaf999194e7c43e5db860dd9713

Download Submit
memory/1164-142-0x0000000000000000-mapping.dmp

Download
memory/4908-150-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Filesize
32KB

Download
memory/4908-146-0x0000000000000000-mapping.dmp

Download
memory/4908-152-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download
memory/4908-151-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download
memory/4908-149-0x0000000000AE0000-0x0000000000B97000-memory.dmp

Filesize
732KB

Download
memory/5004-135-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-137-0x00007FFEC40F0000-0x00007FFEC4100000-memory.dmp

Filesize
64KB

Download
memory/5004-134-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-133-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-136-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-132-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-138-0x00007FFEC40F0000-0x00007FFEC4100000-memory.dmp

Filesize
64KB

Download
memory/5004-154-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-156-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-155-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5004-157-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp

Filesize
64KB

Download
memory/5104-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads