Overview

overview

10

Static

static

8

f60296be31...91.doc

windows7-x64

4

f60296be31...91.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f60296be31ddf2c2fdff731298075391

  • Size

    1.3MB

  • Sample

    221108-nrl73aebg8

  • MD5

    f60296be31ddf2c2fdff731298075391

  • SHA1

    062ede458b20f28e6f4f41e3ae8b2bb491daedc1

  • SHA256

    9199fb34a5a9d5ddeac8989c031c6f2435d7cdd7c3d3311228c9bd3f1edaf722

  • SHA512

    f9505518ebf69340b0fcb15fadb7448c24a6739ae9614280d41b2645b846ca9516586d4957a94168c3a5c55cd4453fa7e6fb632d27c56a63b52795fc9d853d1e

  • SSDEEP

    24576:ZEIZ4wA74D4SQKxZcy8gthDWa/chYusVNVQK0U/q8h:Z+wJD4QZh/q4KMn70uq8

Score
10/10
hancitor2306_vensipdownloadermacromacro_on_action

Malware Config

Extracted

Family

hancitor

Botnet

2306_vensip

C2

http://extilivelly.com/8/forum.php

http://cludimetifte.ru/8/forum.php

http://sakincesed.ru/8/forum.php

Targets

    • Target

      f60296be31ddf2c2fdff731298075391

    • Size

      1.3MB

    • MD5

      f60296be31ddf2c2fdff731298075391

    • SHA1

      062ede458b20f28e6f4f41e3ae8b2bb491daedc1

    • SHA256

      9199fb34a5a9d5ddeac8989c031c6f2435d7cdd7c3d3311228c9bd3f1edaf722

    • SHA512

      f9505518ebf69340b0fcb15fadb7448c24a6739ae9614280d41b2645b846ca9516586d4957a94168c3a5c55cd4453fa7e6fb632d27c56a63b52795fc9d853d1e

    • SSDEEP

      24576:ZEIZ4wA74D4SQKxZcy8gthDWa/chYusVNVQK0U/q8h:Z+wJD4QZh/q4KMn70uq8

    Score
    10/10
    hancitor2306_vensipdownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks