Analysis

  • max time kernel
    0s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2023 01:03

General

  • Target

    1f0284f54fe0a42692373246b30fe0b5.doc

  • Size

    950KB

  • MD5

    1f0284f54fe0a42692373246b30fe0b5

  • SHA1

    9b6b553fdd1df8a20ff97c5fb010b297050d2d00

  • SHA256

    ba37749d25d949955d57888559e1e69bc1fa83ab38422b3e9e3fa70b52e567e1

  • SHA512

    cdde4fc38bf713cbb1fa0398c33a86d107c64b8d28148d86aff5248448b64c18df3ecd02ba67d2748bb6a1d481324f7fa9b33086dbc2e111bf9b92f2fd476bfc

  • SSDEEP

    24576:JEIZ4wA74D4SQKxZcy8gthDWjC4byh3/auWpkE0Wu:J+wJD4QZh/qeGy1aRSE0Wu

Malware Config

Extracted

Family

hancitor

Botnet

1407_bdgtq

C2

http://wortlybeentax.com/8/forum.php

http://omermancto.ru/8/forum.php

http://metweveer.ru/8/forum.php

Signatures

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1f0284f54fe0a42692373246b30fe0b5.doc" /o ""
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2132
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3428
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\ier.dll,HEEPUBQQNOG
        2⤵
        • Process spawned unexpected child process
        PID:4296
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" c:\users\admin\appdata\roaming\microsoft\templates\ier.dll,HEEPUBQQNOG
          3⤵
            PID:4040

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C9301CB9.emf

        Filesize

        4KB

        MD5

        0b7c6928219eda05ea042c41d551679d

        SHA1

        5507fe49a9d82726fe5ce4206d71c19ad65f0eff

        SHA256

        04b3cbf2b5c0a5c1e93aab8719739c31d586d37ea1ff8ed2ac49aa99226005d3

        SHA512

        61914450c8c12fdbad7b381fe23673b6ce5e5f5a141f2ecb36af52cf45edf2e1a7e077742c0e32198aee6d9a3bc07f2c9a6ab5b062d897332267e8a176ce9fc0

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\ier.dll

        Filesize

        65KB

        MD5

        18b779bdfd8cec757976d896c88ef1db

        SHA1

        0cb1f54fee9c5f797c0b52ef943ec5417a2eaad7

        SHA256

        7ae33154ac78b75d7feaade4c2e60e281fef9c36524ee57c8a7f3976711df061

        SHA512

        d9ab4f5bcbfe82c4c78a6a0c8e7f485578984d9bfbd157add5deaa40ea31f954a7e0737fd262fd519fd19d53114bd8153b74222932ddcf0f025f2b8fa806a143

      • \??\c:\users\admin\appdata\roaming\microsoft\templates\ier.dll

        Filesize

        76KB

        MD5

        1baff1563115f09747f25f0c98c3d2b1

        SHA1

        68fa2171438eaf6322ba5262260afec202cd22bd

        SHA256

        268f880fdcd763f76485d3fe9810b7074f1f07d57bcb851f955655acd197155e

        SHA512

        51b388464c9a00877441fe3dad3c28509d3744ee75419fd7d8df560cd5db8c5fec08418163789cab1e9702b18657991bfb0e77026a4ff033d4300ecbd1db8962

      • memory/2132-58-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-5-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-7-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-64-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-4-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-8-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-11-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-12-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-13-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-10-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-9-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-15-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-14-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-16-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-17-0x00007FF8492E0000-0x00007FF8492F0000-memory.dmp

        Filesize

        64KB

      • memory/2132-3-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-28-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-42-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-43-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-0-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-117-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-6-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-18-0x00007FF8492E0000-0x00007FF8492F0000-memory.dmp

        Filesize

        64KB

      • memory/2132-1-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-73-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-2-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-118-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-78-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-80-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-120-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-81-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-82-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-83-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-85-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-86-0x0000016AEB2B0000-0x0000016AEC280000-memory.dmp

        Filesize

        15.8MB

      • memory/2132-119-0x00007FF84B670000-0x00007FF84B680000-memory.dmp

        Filesize

        64KB

      • memory/2132-121-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-123-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2132-122-0x00007FF88B5F0000-0x00007FF88B7E5000-memory.dmp

        Filesize

        2.0MB

      • memory/4040-79-0x0000000074D60000-0x0000000074E4E000-memory.dmp

        Filesize

        952KB

      • memory/4040-74-0x0000000074D60000-0x0000000074E4E000-memory.dmp

        Filesize

        952KB

      • memory/4040-75-0x0000000000A80000-0x0000000000A81000-memory.dmp

        Filesize

        4KB

      • memory/4040-126-0x0000000074D60000-0x0000000074E4E000-memory.dmp

        Filesize

        952KB