THREAT IDENTIFICATION:  HANCITOR

SUBJECTS OBSERVED
You got notification from DocuSign Service
You received invoice from DocuSign Electronic Signature Service
You received invoice from DocuSign Service
You received invoice from DocuSign Signature Service
You received notification from DocuSign Electronic Service

SENDERS OBSERVED
ateka@powersandassociates.com
ibysmuo@powersandassociates.com
ru@powersandassociates.com
sseux@powersandassociates.com
yg@powersandassociates.com

HANCITOR MALDOC DOWNLOAD URLS
https://ticket.saleseos.com/view/js/plugins/ckeditor/adapters/candor.php
https://ch.trustzonecam.com/user_guide/_static/css/unsigned.php

saleseos.com
trustzonecam.com

MALDOC FILE HASHES
6414c74e29eb9ed9422d49ffd01629f4
bfb20182e990f93d22f83db7c2068ac0

SECONDARY MALDOC DOWNLOAD URL
http://dodro7.ru/berp.doc

SECONDARY MALDOC FILE HASH
berp.doc
4a3d09296a43f949146ebc43e77bdfe4

HANCITOR DUMPED BAT FILE HASH
1.bat
22bc5515447c5df4c2c33825c08ba9bc

HANCITOR BAT FILE CONTENTS
cmd.exe /c ping localhost -n 10 && rundll32.exe moexx.bin,LXWSHMPNSLEIGKL

HANCITOR PAYLOAD FILE HASH
moexx.bin
d90f5bb9e103ea6935e453a8bafe4a66

HANCITOR C2
http://otedsalon.com/9/forum.php
http://vewdeposd.ru/9/forum.php
http://ybirelin.ru/9/forum.php

HANCITOR BUILD NUMBER
BUILD=0102_qapldk

COBALT STRIKE STAGER DOWNLOAD URLS
http://dodro7.ru/107.bin
http://dodro7.ru/107s.bin

COBALT STRIKE STAGER FILE HASHES
107.bin
ff21807262469cdfd53715d06de73a3a

107s.bin
4ef3829fa140e06cd17ab5e0a3ef7de3

COBALT STRIKE BEACON DOWNLOAD URLS
http://198.74.126.107/6zTX
https://198.74.126.107/3dkZ

COBALT STRIKE BEACON FILE HASH (both the same file hash)
3dkZ
383dd8ae09f98f47ee4298120d22bedc

6zTX
383dd8ae09f98f47ee4298120d22bedc

COBALT STRIKE BEACON C2s
http://198.74.126.107/visit.js

EXTRACTED COBALT STRIKE BEACON CONFIGURATION
payloadType: 0x10015044
payloadSize: 0x00000000
intxorkey: 0x00000000
id2: 0x00000000
Config found: xorkey b'.' 0x00030620 0x00033800
0x0001 payload type                     0x0001 0x0002 0 windows-beacon_http-reverse_http
0x0002 port                             0x0001 0x0002 80
0x0003 sleeptime                        0x0002 0x0004 60000
0x0004 maxgetsize                       0x0002 0x0004 1048576
0x0005 jitter                           0x0001 0x0002 0
0x0007 publickey                        0x0003 0x0100 30819f300d06092a864886f70d010101050003818d0030818902818100a70991d69d816a601ffa80976473830f0d3b41276d2790401ddedb18e2d3cab3c315e3222325be42b65adb2878f33f5a03ff5010b23e842a510c1482ad6a42f1e7e5726eb31813e7437640ed7879955f401e172c34d3517241596dd41f8e48d3d1b1c288e6c8752ff65dc27acccba4ba9cd6d0e4de6196cea4da480d3b99d0ed020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
0x0008 server,get-uri                   0x0003 0x0100 '198.74.126.107,/visit.js'
0x0043                                  0x0001 0x0002 0
0x0044                                  0x0002 0x0004 4294967295
0x0045                                  0x0002 0x0004 4294967295
0x0046                                  0x0002 0x0004 4294967295
0x000e SpawnTo                          0x0003 0x0010 (NULL ...)
0x001d spawnto_x86                      0x0003 0x0040 '%windir%\\syswow64\\rundll32.exe'
0x001e spawnto_x64                      0x0003 0x0040 '%windir%\\sysnative\\rundll32.exe'
0x001f CryptoScheme                     0x0001 0x0002 0
0x001a get-verb                         0x0003 0x0010 'GET'
0x001b post-verb                        0x0003 0x0010 'POST'
0x001c HttpPostChunk                    0x0002 0x0004 0
0x0025 license-id                       0x0002 0x0004 1580103824
0x0026 bStageCleanup                    0x0001 0x0002 0
0x0027 bCFGCaution                      0x0001 0x0002 0
0x0009 useragent                        0x0003 0x0100 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)'
0x000a post-uri                         0x0003 0x0040 '/submit.php'
0x000b Malleable_C2_Instructions        0x0003 0x0100 '\x00\x00\x00\x04'
0x000c http_get_header                  0x0003 0x0200
  b'Cookie'
0x000d http_post_header                 0x0003 0x0200
  b'&Content-Type: application/octet-stream'
  b'id'
0x0036 HostHeader                       0x0003 0x0080 (NULL ...)
0x0032 UsesCookies                      0x0001 0x0002 1
0x0023 proxy_type                       0x0001 0x0002 2 IE settings
0x003a                                  0x0003 0x0080 '\x00\x04'
0x0039                                  0x0003 0x0080 '\x00\x04'
0x0037                                  0x0001 0x0002 0
0x0028 killdate                         0x0002 0x0004 0
0x0029 textSectionEnd                   0x0002 0x0004 0
0x002b process-inject-start-rwx         0x0001 0x0002 64 PAGE_EXECUTE_READWRITE
0x002c process-inject-use-rwx           0x0001 0x0002 64 PAGE_EXECUTE_READWRITE
0x002d process-inject-min_alloc         0x0002 0x0004 0
0x002e process-inject-transform-x86     0x0003 0x0100 (NULL ...)
0x002f process-inject-transform-x64     0x0003 0x0100 (NULL ...)
0x0035 process-inject-stub              0x0003 0x0010 '"+\x8f\'Ûߺ\x8dÝU\x9eì¢~¦H'
0x0033 process-inject-execute           0x0003 0x0080 '\x01\x02\x03\x04'
0x0034 process-inject-allocation-method 0x0001 0x0002 0
0x0000