Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 19:14

General

  • Target

    c6a955feba1b9e85859176043a1a274c.doc

  • Size

    539KB

  • MD5

    c6a955feba1b9e85859176043a1a274c

  • SHA1

    31e397116cb4a2ec8188f9b51c0b980389031689

  • SHA256

    25b1a6b2d713499b4d483d782626ff8f8622bfa1b078a6641d2efbe615db1ffd

  • SHA512

    8c06e70f6b85011f82ef45fc9f605722b4a6037aea8340482dbafd68bbd647a69fbd028fbb9cbf69f7b4250de65013cb76a8c082af746b67f7d68d47a56451bf

  • SSDEEP

    12288:hV9iQsDr8NQhqNrdjqLCV8L/EnqO1BKI9vIOaCuQByhC1A5/U:hVXkr8NpNrAmqL/EnJ1BsrPzhN5M

Malware Config

Extracted

Family

hancitor

Botnet

0308_spnv5

C2

http://priekornat.com/8/forum.php

http://stionsomi.ru/8/forum.php

http://arviskeist.ru/8/forum.php

Signatures

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c6a955feba1b9e85859176043a1a274c.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:5252
      • C:\Windows\SYSTEM32\rundll32.exe
        rundll32 c:\users\admin\appdata\roaming\microsoft\templates\ier.dll,NXYSYMIUJMD
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 c:\users\admin\appdata\roaming\microsoft\templates\ier.dll,NXYSYMIUJMD
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3692

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1CBC4233.emf

      Filesize

      4KB

      MD5

      ff6a77c6072d38dad1ded7fe7b1cdfa1

      SHA1

      5c3457475f3584d18ba5a5d765fce16ce16f69c5

      SHA256

      dafca1618afa2cd4e9f89e97bfd0e7aea61453ddca26ba7de4e2045a2e85bc84

      SHA512

      d7e30e96bd765349648c63e093d64899355b769bd4a2878bd0006fc97f350fc1f1a479f7b7552ecdba907822297bdd0f2366f7bbd1fc53f7e6360e4890c7e46f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5B60207A.emf

      Filesize

      4KB

      MD5

      8054abe59b2badee71e12edb5e1db182

      SHA1

      150f33966a99e449b498eb8f2552b56db0cd09a9

      SHA256

      ea0cebe8874b6b4977a59759638015bc125f5e768f74056b74fe9bf55df0115d

      SHA512

      0673867f1466ddd63f222e316e8484604dc1cfd4ab4e76ec04713a951e8ce9fd4ecf4222be8b9dc0d95f70772843b83f600de12e78072daba7bd144791eb261b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      237B

      MD5

      f97ce128e09ed76f8d746e835ad41de3

      SHA1

      801c10655753020a0fd41ed43ac8095d622904e1

      SHA256

      05c26bcb60ae5c262da5040e9382b0b1915aa59904926ac107f25617b624172f

      SHA512

      45c0e5eb7693617ab03a1c1e40eb25b1f3ee00069a4bfbbfe59ad4fd208f4d8eb34c58b5af7d7643a997292ac667eff4b8eacd32fd8e7660ab6b2deda3838d0c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\qq.doc

      Filesize

      360KB

      MD5

      3aae62f48791f830ed66e46a725c7186

      SHA1

      52bf6707f417eec0290b871283d9937c4f570c28

      SHA256

      51843894f91faada6a71a0dc972a883a4e19da2f9416735dc9149de9e4b67a19

      SHA512

      4d5e8cea4c736a5bcbab717389701959f2623bff0c1306f792ffbf84199a370e73868e1a8c0db2b37d5e3cfda6c5653fa14ff54902d1f74722325f4dfaf4941a

    • \??\c:\users\admin\appdata\roaming\microsoft\templates\ier.dll

      Filesize

      654KB

      MD5

      d7c87a735968d424d5c0aa2794d23657

      SHA1

      957a6ef9961e71d0207c5ab2ccc153b41f73e110

      SHA256

      306d564fba556c9db12269b01bdadb3eba19e43c60f180c6f41a72a1fc9840d3

      SHA512

      5ef0e40f059cb752421af3123deef73df4544fe1653efdfdfa277ed879d06f6eb6d6ff5234ae159746f2dc9bbc167273851c1a14ace3f38bcd1661828b0e35d5

    • memory/2192-51-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-212-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-8-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-5-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-9-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-11-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-10-0x00007FFCA9E50000-0x00007FFCA9E60000-memory.dmp

      Filesize

      64KB

    • memory/2192-12-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-13-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-14-0x00007FFCA9E50000-0x00007FFCA9E60000-memory.dmp

      Filesize

      64KB

    • memory/2192-15-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-16-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-17-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-18-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-19-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-20-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-21-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-22-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-37-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-40-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-41-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-42-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-0-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-54-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-61-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-60-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-6-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-7-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-214-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-3-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-2-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-213-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-4-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-211-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-151-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

      Filesize

      2.0MB

    • memory/2192-155-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-156-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-210-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-1-0x00007FFCABFB0000-0x00007FFCABFC0000-memory.dmp

      Filesize

      64KB

    • memory/2192-162-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-168-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-169-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-170-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-171-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-172-0x000002C55AC50000-0x000002C55BC20000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-174-0x000002C55FA60000-0x000002C560A30000-memory.dmp

      Filesize

      15.8MB

    • memory/2192-92-0x000002C55FA60000-0x000002C560A30000-memory.dmp

      Filesize

      15.8MB

    • memory/3692-175-0x00000000007C0000-0x00000000007C8000-memory.dmp

      Filesize

      32KB

    • memory/3692-159-0x0000000000C80000-0x0000000000D27000-memory.dmp

      Filesize

      668KB

    • memory/3692-148-0x00000000007E0000-0x00000000007EA000-memory.dmp

      Filesize

      40KB

    • memory/3692-147-0x00000000007C0000-0x00000000007C8000-memory.dmp

      Filesize

      32KB

    • memory/3692-146-0x0000000000C80000-0x0000000000D27000-memory.dmp

      Filesize

      668KB

    • memory/3692-176-0x00000000007E0000-0x00000000007EA000-memory.dmp

      Filesize

      40KB