Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2023 19:17

General

  • Target

    81c4485a834880c3becd7e3eefd841a3.doc

  • Size

    850KB

  • MD5

    81c4485a834880c3becd7e3eefd841a3

  • SHA1

    a1d76eaf5c4f787fc34528e46dc9cda5d9d5ea28

  • SHA256

    87df253ffe9d319d5a315b3361a1d13553c3bc4bf233e5c93a8624b5993f4abe

  • SHA512

    09076ecc53e4ad0d27c783918ca6c74dbf81cdb11c47c232afe8044e372aeb4920a488e1320c0cad9267d2fb747e2dc3e9e7c265021bba6b3dbec14daffe104f

  • SSDEEP

    12288:OB+jxjYxBs/RPYdf2aCQeg1Mfpfm6ukJm9voPZqXStgi2Tz:OSjeG/usvQFMfQmJmVsZ/C/

Malware Config

Extracted

Family

hancitor

Botnet

0710_pkrdv

C2

http://strictence.com/8/forum.php

http://wimberels.ru/8/forum.php

http://cithernista.ru/8/forum.php

Signatures

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\81c4485a834880c3becd7e3eefd841a3.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4860
      • C:\Windows\SYSTEM32\rundll32.exe
        rundll32.exe c:\users\admin\appdata\roaming\microsoft\templates\gelforr.dap,CBVBXIFEAWN
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe c:\users\admin\appdata\roaming\microsoft\templates\gelforr.dap,CBVBXIFEAWN
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:2388

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\52C9168.emf

      Filesize

      4KB

      MD5

      4fdbdbea9a28741ed9f8094f6ec88cd8

      SHA1

      044ae1449f0c7802273d050e836255c3d39cc2e8

      SHA256

      59388fdf2fd0cf29043059eac189ab2832f8fff5bb4f6f974456ea37ca61f9e4

      SHA512

      a24fc69f35d474feeab212315c9414d52b36e3b661eaab80970b64540cdff6ca536297b872c7d8d6ebef5491048f2592b43aa1637f7b999ac32220b39f61619f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B9674C43.emf

      Filesize

      4KB

      MD5

      0d086ac2dd40e23a8b5e5a45857436b6

      SHA1

      7ecde15ab361d7543199e009199b050175bd7c15

      SHA256

      034db7e2f2dd149beb63e78cc4eb210e6e5a2a85ab98858537ce5fa572c20b03

      SHA512

      20648e8a408dceaa571b099471f102754a9d5c9455453ae82b54bb7571626960a9ec030ab6f0c27c6b09603e61293f080491ef7ffb77ff5128b45a07ce0f632a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      241B

      MD5

      f5310e4d57eb4bfd0514b4070f46def9

      SHA1

      69392ae127b33f86e844982957a6d761d5368603

      SHA256

      2c8c3924add47db70a6449b6b493f71f6d045b7cb156bd2112a67724e5fad50c

      SHA512

      489cc600baa5d96584c1f40cc9eac34138543ed1325c7b109523cbd1028a880cddbc6c49ce089c961d157890a50c1761436facf83c46d87cbf21ca1ebbb54726

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\zoro.doc

      Filesize

      242KB

      MD5

      a9f3f37f2b708c5bf3939fe5171ff5e9

      SHA1

      fb217ca0f6a0bf004c9a4eaf4ffe789556aebf81

      SHA256

      32b025ef95aee1a9a2a24a7df37a833431d6331b442bb5cb7e86499e4e5c51ea

      SHA512

      596eae8125a8530d0629e6d371abbef6af5b388d60be999cb1bd86343b0f15846a462d548af27679d73f7fccafdf080a5ebcd9559e83029d427b7493ffc98b78

    • \??\c:\users\admin\appdata\roaming\microsoft\templates\gelforr.dap

      Filesize

      379KB

      MD5

      bbd29e739b97fe15d72d58471019e7eb

      SHA1

      d0557e06b22ee0706ece4cc7559136da70267006

      SHA256

      ede4c71a7d7a09d4da1860cbfec4a0a02104b510eb359883e3276a018f39ead8

      SHA512

      c9e658549939bde3817c1f0c06c1dbe0e6b9fb75799e5d95d62c046416dd5b21bf05721c4cac871a5f2e685a2e7556ec48988f6cbbe44e8278fce8a9f595e69c

    • memory/1124-14-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-11-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-8-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-6-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-9-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-10-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-3-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-12-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-13-0x00007FF982D10000-0x00007FF982D20000-memory.dmp

      Filesize

      64KB

    • memory/1124-0-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-15-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-16-0x00007FF982D10000-0x00007FF982D20000-memory.dmp

      Filesize

      64KB

    • memory/1124-17-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-18-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-19-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-20-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-21-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-22-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-2-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-41-0x0000022037660000-0x0000022038630000-memory.dmp

      Filesize

      15.8MB

    • memory/1124-66-0x00000220342F0000-0x0000022034AF0000-memory.dmp

      Filesize

      8.0MB

    • memory/1124-4-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-5-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-1-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-23-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-7-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-229-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-176-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-177-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-178-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-179-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-180-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-181-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-182-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-183-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-184-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-185-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-186-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-187-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-188-0x0000022037660000-0x0000022038630000-memory.dmp

      Filesize

      15.8MB

    • memory/1124-189-0x00000220342F0000-0x0000022034AF0000-memory.dmp

      Filesize

      8.0MB

    • memory/1124-230-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-174-0x00007FF9C54F0000-0x00007FF9C56E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1124-228-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-227-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/1124-226-0x00007FF985570000-0x00007FF985580000-memory.dmp

      Filesize

      64KB

    • memory/2388-196-0x00000000006B0000-0x00000000006B1000-memory.dmp

      Filesize

      4KB

    • memory/2388-193-0x0000000074880000-0x0000000074983000-memory.dmp

      Filesize

      1.0MB

    • memory/2388-192-0x00000000006B0000-0x00000000006B1000-memory.dmp

      Filesize

      4KB

    • memory/2388-191-0x0000000074880000-0x0000000074983000-memory.dmp

      Filesize

      1.0MB

    • memory/2388-190-0x0000000074880000-0x0000000074983000-memory.dmp

      Filesize

      1.0MB