Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 17:29

General

  • Target

    877860610fc42b1b257a6190a8c83b11.doc

  • Size

    612KB

  • MD5

    877860610fc42b1b257a6190a8c83b11

  • SHA1

    ce480630cfd1bf1249ba3921ccec1039ddfa69cc

  • SHA256

    f9fdb0d3bdfc7e5305bc9444c832a8900a77006ff54a2660c973fec4afa4ab60

  • SHA512

    ff1ce342d826ad1f35446265b8dd491c388207b2eaa739b8d8ec7089a9571f0af1ff816b954681ca78bb490cf93e68a7075074645f9c52ada1bce46e2e59c255

  • SSDEEP

    12288:sV9iQsDr8NVeCz3DFw7m/kdxoF3aHUp6BvNoywaMFsZjjotAd5Rs+:sVXkr8N4Cz6voFqDisSID

Malware Config

Extracted

Family

hancitor

Botnet

1808_plfr

C2

http://madmilons.com/8/forum.php

http://counteent.ru/8/forum.php

http://simatereare.ru/8/forum.php

Signatures

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\877860610fc42b1b257a6190a8c83b11.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4436
      • C:\Windows\SYSTEM32\rundll32.exe
        rundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,DJJEQGVHMRG
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1928
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,DJJEQGVHMRG
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B3D56CF9.emf

      Filesize

      4KB

      MD5

      2d132b8d63a6ada5df4919d1c9630a51

      SHA1

      173e4c5e4b79a252fe729273e45790326f1fae4f

      SHA256

      99eff9f9f8b287ee675cac900b549c7bff212e743cdc9785190d087cda93a0f6

      SHA512

      16ee35a0c741d33a7480f04e616e228413b1933820e96df4e9deca857ade107d5e07c3aae63c6b092d052b9792ea70313801ff0abae24ef806e405b1d9d8492b

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CF92BEA6.emf

      Filesize

      4KB

      MD5

      b5ed963e5b24f2b139b9fc68c72fce85

      SHA1

      93d7ddb535070e05af7ead9517efb9fbefd3ce48

      SHA256

      d7922ee96fa7ba7fc7518b4a1c4e19e0460dc39cf6170ae610290d4c29fbde99

      SHA512

      a75ff876c26b897899753153879969f0d34779f94473ac0dd6fa135cdc3f10875a774587c03284f30bed8fcf6a3a6eade8a7ea2a024864ba32556cc886029300

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      241B

      MD5

      8963cb4123157464aa66928b3a910108

      SHA1

      b9624233909e2bd04742654ba82288ab60528e73

      SHA256

      59b4b5d813cd6d08d5895317ada4f6e5835286d7ecdf324f142474f34a22c565

      SHA512

      87799850de5ae1d4f7aca70c22e68f873e6440565895dd7a029b9bde9af6004d09b9338b398aec43c9cc2eb9e78844edf8fde45c2efe8c7d97e8bbb783763f6c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\glib.doc

      Filesize

      130KB

      MD5

      78e51f05e6bef6bc17f4b1f6ab1c894d

      SHA1

      90e9ecef8f61b7caffc20b7ef05d08629edd1b4c

      SHA256

      96164a842b3ad303058c85ad5976ed37a2dc2fff7e818207cd4070aebdb3a4b6

      SHA512

      701a6982aa42c59caf69c7a78042c0883bfd247f55cb4f17aeeb063e7643b7b43514a884fc67c96345ebad7106f14410a3b5fd91230f3247fecb5290e56a4ec3

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\yefff.dll

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • \??\c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll

      Filesize

      95KB

      MD5

      b2b1ac23adeb8d1a82c7150681aa122d

      SHA1

      d742203f18d0b2dd3aa8d84c4f9e949d3cde84ee

      SHA256

      f39f0b2340322d754362f13907c7d29b4c3e802efc06a6c57659499042ab37be

      SHA512

      4c0bafa74b390598e2c8856280e5b6ff4826769b91abcb736b385c94a1884d12a475eb6980f6cf5bd079933eea69d6a1e82ac101a934a4acff1107d4ffd83902

    • memory/3380-184-0x00000000025E0000-0x00000000025EA000-memory.dmp

      Filesize

      40KB

    • memory/3380-183-0x00000000025C0000-0x00000000025C8000-memory.dmp

      Filesize

      32KB

    • memory/3380-167-0x0000000000400000-0x00000000004CC000-memory.dmp

      Filesize

      816KB

    • memory/3380-154-0x00000000025E0000-0x00000000025EA000-memory.dmp

      Filesize

      40KB

    • memory/3380-152-0x00000000025C0000-0x00000000025C8000-memory.dmp

      Filesize

      32KB

    • memory/4508-119-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-150-0x000001D138DB0000-0x000001D139D80000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-14-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-13-0x00007FF90CE10000-0x00007FF90CE20000-memory.dmp

      Filesize

      64KB

    • memory/4508-12-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-9-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-8-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-6-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-5-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-4-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-33-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-3-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-42-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-45-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-2-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-0-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-64-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-18-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-71-0x000001D12DD50000-0x000001D12E150000-memory.dmp

      Filesize

      4.0MB

    • memory/4508-72-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-20-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-23-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-97-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-1-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-136-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-21-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-146-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-22-0x00007FF90CE10000-0x00007FF90CE20000-memory.dmp

      Filesize

      64KB

    • memory/4508-149-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-17-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-147-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-143-0x000001D138DB0000-0x000001D139D80000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-151-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-19-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-16-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-153-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-155-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-156-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-157-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-163-0x000001D12DD50000-0x000001D12E150000-memory.dmp

      Filesize

      4.0MB

    • memory/4508-164-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-15-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-168-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-169-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-170-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-11-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-177-0x000001D138DB0000-0x000001D139D80000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-179-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-180-0x000001D133280000-0x000001D134250000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-182-0x000001D138DB0000-0x000001D139D80000-memory.dmp

      Filesize

      15.8MB

    • memory/4508-10-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-7-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-219-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-220-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-221-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-223-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-222-0x00007FF90F770000-0x00007FF90F780000-memory.dmp

      Filesize

      64KB

    • memory/4508-225-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB

    • memory/4508-224-0x00007FF94F6F0000-0x00007FF94F8E5000-memory.dmp

      Filesize

      2.0MB