Overview

overview

10

Static

static

8

9b28f78ebb...ef.doc

windows7-x64

4

9b28f78ebb...ef.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b28f78ebb97bc88b473fb92cafd03ef

  • Size

    1.3MB

  • Sample

    221108-nrs1lseca4

  • MD5

    9b28f78ebb97bc88b473fb92cafd03ef

  • SHA1

    345524df277ae83f974dbb121b01b571b7d7f528

  • SHA256

    da8996a9e24fb4286a984cb02a21b613232ba9afcaaa0949d18d4ca11d08ccf1

  • SHA512

    03dbff5c4d8b1038de19beb2878b2d76c344a75a4eb844914770b866974566fc9addc1e30bd18939b8663f51c924108353524eacb0772db29cb9e944de723788

  • SSDEEP

    24576:mEIZ4wA74D4SQKxZcy8gthDW4/chYusVNVQK0U/S8mB:m+wJD4QZh/qWKMn70uS8K

Score
10/10
hancitor2306_vensipdownloadermacromacro_on_action

Malware Config

Extracted

Family

hancitor

Botnet

2306_vensip

C2

http://extilivelly.com/8/forum.php

http://cludimetifte.ru/8/forum.php

http://sakincesed.ru/8/forum.php

Targets

    • Target

      9b28f78ebb97bc88b473fb92cafd03ef

    • Size

      1.3MB

    • MD5

      9b28f78ebb97bc88b473fb92cafd03ef

    • SHA1

      345524df277ae83f974dbb121b01b571b7d7f528

    • SHA256

      da8996a9e24fb4286a984cb02a21b613232ba9afcaaa0949d18d4ca11d08ccf1

    • SHA512

      03dbff5c4d8b1038de19beb2878b2d76c344a75a4eb844914770b866974566fc9addc1e30bd18939b8663f51c924108353524eacb0772db29cb9e944de723788

    • SSDEEP

      24576:mEIZ4wA74D4SQKxZcy8gthDW4/chYusVNVQK0U/S8mB:m+wJD4QZh/qWKMn70uS8K

    Score
    10/10
    hancitor2306_vensipdownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks