This week RSA FirstWatch observed a new malspam campaign delivering Hancitor malware. Hancitor is a downloader that was used by adversaries to deliver various malware families such as Pony and Zeus Panda Banker. Contrary to previous malspam campaigns that used VBA macros to deliver Hancitor, this one is exploiting CVE-2017-11882 in malicious RTF documents.
Invoice_304550.doc and fax_645751.doc are two examples of the RTF documents used in this campaign. Opening them with an un-patched instance of Microsoft Word leaves a user with a blank page. However, a lot of activity is happening in the background.
First, a suspicious retrieves "1", a script containing our Hancitor payload as a Base64 encoded blob along with the necessary commands to decode and start it as a new process.
Looking at the HTTP GET, many of headers in the request are curiously absent.
NetWitness Packets flags suspicious meta data (e.g., the file.analysis and service.analysis tags shown below).
Next, there is a request to a service to idenitfy the IP address of the victim machine:
Then, it checks-in with a C2 domain (undronride[.]ru) sending the host information via an HTTP POST request. The directory and filename used in the request reflect the telltale 'ls5/forum.php' characteristics of Hancitor.
It is worth noting that the C2 domain, undronride[.]ru, was registered just seven days ago and lacks a surprising amount of registration information.
A second C2 callback to the CNOBIN-registered littarhapone[.]com was also generated by the malware.
The following screenshot shows the meta populated by NetWitness Packets for these C2 check-in sessions:
In both cases, there were no binaries downloaded after the check-in. However, this SANS blog post discusses some of the additional payloads delivered by this Hancitor campaign.
All the IOC from those HTTP sessions were added to RSA FirstWatch Command and Control Domains on Live with the following meta:
- threat.source = ‘rsa-firstwatch’
- threat.category = ‘malspam’
- threat.description = ‘delivery-domain’
Delivery documents (SHA256):
- b489ca02dcea8dc7d5420908ad5d58f99a6fef160721dcecfd512095f2163f7a
- 6dcbf652b96a7aea16d0c2e72186173d9345f722c9592e62820bcfe477b2b297
