By Sriram P & Lakshya Mathur
Hancitor, a loader that provides Malware as a Service, has been observed distributing malware such as FickerStealer, Pony, CobaltStrike, Cuba Ransomware, and many more. Recently at McAfee Labs, we observed Hancitor Doc VBA (Visual Basic for Applications) samples dropping the payload using the Windows clipboard through Selection.Copy method.
This blog focuses on the effectiveness of this newly observed technique and how it adds an extra layer of obfuscation to evade detection.
Below (Figure 1) is the Geolocation based stats of Hancitor Malicious Doc observed by McAfee since September 2021
INFECTION CHAIN
- The victim will receive a Docusign-based phishing email.
- On clicking on the link (hxxp://mettlybothe.com/8/forum[.]php), a Word Document file is downloaded.
- On Enabling the macro content in Microsoft Word, the macro drops an embedded OLE, a password-protected macro-infected document file and launches it.
- This second Document file drops the main Hancitor DLL (Dynamic Link Library) payload.
- The DLL payload is then executed via rundll32.exe.
TECHNICAL ANALYSIS
Malware authors send the victims a phishing email containing a link as shown in the below screenshot (Figure 3). The usual Docusign theme is used in this recent Hancitor wave. This phishing email contains a link to the original malicious word document. On clicking the link, the Malicious Doc file is downloaded.
Since the macros are disabled by default configuration, malware authors try to lure victims into believing that the file is from legitimate organizations or individuals and will ask victims to enable editing and content to start the execution of macros. The screenshot below (Figure 4) is the lure technique that was observed in this current wave.
As soon as the victim enables editing, malicious macros are executed via the Document_Open function.
There is an OLE object embedded in the Doc file. The screenshot below (Figure 5) highlights the object as an icon.
The loader VBA function, invoked by document_open, calls this random function (Figure 6), which moves the selection cursor to the exact location of the OLE object using the selection methods (.MoveDown, .MoveRight, .MoveTypeBackspace). Using the Selection.Copy method, it will copy the selected OLE object to the clipboard. Once it is copied in the clipboard it will be dropped under %temp% folder.
When an embedded object is being copied to the clipboard, it gets written to the temp directory as a file. This method is used by the malware author to drop a malicious word document instead of explicitly writing the file to disk using macro functions like the classic FileSystemObject.
In this case, the file was saved to the %temp% location with filename name “zoro.kl” as shown in the below screenshot (Fig 8). Fig 7 shows the corresponding procmon log involving the file write event.
Using the CreateObject(“Scripting.FileSystemObject”) method, the malware moves the file to a new location AppdataRoamingMicrosoftTemplates and renames it to “zoro.doc”.
This file is then opened with the built-in document method, Documents.open. This moved file, zoro.doc, is password-protected. In this case, the password used was “doyouknowthatthegodsofdeathonlyeatapples?”. We have also seen the usage of passwords like “donttouchme”, etc.
This newly dropped doc is executed using the Documents.Open function (Figure 11).
Zoro.doc uses the same techniques to copy and drop the next payload as we saw earlier. The only difference is that it has a DLL as the embedded OLE object.
It drops the file in the %temp% folder using clipboard with the name “gelforr.dap”. Again, it moves gelforr.dap DLL file to AppdataRoamingMicrosoftTemplates (Figure 12).
Finally, after moving DLL to the templates folder, it is executed using Rundll32.exe by another VBA call.
MITRE ATT&CK
| Technique ID | Tactic | Technique details |
| T1566.002 | Initial Access | Spam mail with links |
| T1204.001 | Execution | User Execution by opening the link. |
| T1204.002 | Execution | Executing downloaded doc |
| T1218 | Defense Evasion | Signed Binary Execution Rundll32 |
| T1071 | C&C (Command & Control) | HTTP (Hypertext Transfer Protocol) protocol for communication |
IOC (Indicators Of Compromise)
| Type | SHA-256 | Scanner | Detection Name |
| Main Doc | 915ea807cdf10ea4a4912377d7c688a527d0e91c7777d811b171d2960b75c65c | WSS | W97M/Dropper.im |
| Dropped Doc | c1c89e5eef403532b5330710c9fe1348ebd055d0fe4e3ebbe9821555e36d408e | WSS | W97M/Dropper.im |
| Dropped DLL | d83fbc9534957dd464cbc7cd2797d3041bd0d1a72b213b1ab7bccaec34359dbb | WSS | RDN/Hancitor |
| URLs (Uniform Resource Locator) | hxxp://mettlybothe.com/8/forum[.]php | WebAdvisor | Blocked |