Analysis
- max time kernel
7s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/01/2024, 06:34
General
- Target 48463e9423607e7e5fbb05b42a3bc4ae.doc
- Size 623KB
- Sample240107-hb7aeahbc9
- SHA256 cef7ccf63ab0648d312c44000f29f93d672e6a99a8ab5d08b599719d3f2ac23d
Malware Config
Extracted
-
hancitor
-
1908_jkdsf
-
http://thookedaurce.com/8/forum.php
-
http://foolockpary.ru/8/forum.php
-
http://usitemithe.ru/8/forum.php
Signatures
- Hancitor
Hancitor is downloader used to deliver other malware families.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\48463e9423607e7e5fbb05b42a3bc4ae.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,KBLQIJOPAQU2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,KBLQIJOPAQU3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1892-154-0x00000000012C0000-0x00000000012CA000-memory.dmp
memory/1892-178-0x00000000012C0000-0x00000000012CA000-memory.dmp
memory/1892-160-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/1892-153-0x00000000012A0000-0x00000000012A8000-memory.dmp
memory/4856-36-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-217-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-6-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-4-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-3-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-2-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-0-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-11-0x00007FF93D9B0000-0x00007FF93D9C0000-memory.dmp
memory/4856-12-0x00007FF93D9B0000-0x00007FF93D9C0000-memory.dmp
memory/4856-149-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-1-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-37-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-46-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-55-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-61-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-86-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-92-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-125-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-135-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-136-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-141-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-145-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-148-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-152-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-10-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-9-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-8-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-151-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-30-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-147-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-146-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-144-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-143-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-142-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-140-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-139-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-158-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-159-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-7-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-161-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-164-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-165-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-166-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-174-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-175-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-177-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-5-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-180-0x0000025293290000-0x0000025294260000-memory.dmp
memory/4856-150-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-218-0x00007FF97F990000-0x00007FF97FB85000-memory.dmp
memory/4856-216-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-215-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-214-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp
memory/4856-213-0x00007FF93FA10000-0x00007FF93FA20000-memory.dmp