Full Report
Hancitor fuels Cuba Ransomware Operations
Analysis Summary
# Tool/Technique: Hancitor (leading to Cuba Ransomware)
## Overview
Hancitor (also known as Chanitor) is a prolific malware loader primarily delivered via phishing campaigns. In recent operations, it has served as the initial entry point for complex attack chains that culminate in the deployment of **Cuba Ransomware**. It functions as a delivery mechanism for secondary payloads such as information stealers, Cobalt Strike beacons, and ultimately, encryption tools.
## Technical Details
- **Type:** Malware Family (Loader / Downloader)
- **Platform:** Windows
- **Capabilities:** Credential theft, dropper functionality, process injection, and establishing persistence.
- **First Seen:** Hancitor has been active since approximately 2014; the specific campaign fueling Cuba Ransomware was observed prominently in early 2021.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- **[TA0005 - Defense Evasion]**
- [T1055 - Process Injection]
- [T1027 - Obfuscated Files or Information]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
## Functionality
### Core Capabilities
- **Multi-Stage Loading:** Utilizes malicious documents (macro-enabled) to drop and execute the primary Hancitor DLL.
- **Payload Delivery:** Downloads and executes secondary tools including **Ficker Stealer** (for credential harvesting) and **Cobalt Strike** beacons.
- **Information Gathering:** Collects basic host information (computer name, domain, IP) to send back to the C2.
### Advanced Features
- **Redundancy:** Employs **SystemBC** as an additional backdoor to maintain access even if Cobalt Strike activity is detected and terminated.
- **Administrative Enablement:** Uses custom scripts to enable RDP connections and modify Windows Firewall rules to facilitate lateral movement.
- **Encryption Scheme:** The final Cuba Ransomware payload uses **ChaCha20** with a 12-byte IV for file encryption, with keys protected by **RSA-4096**.
## Indicators of Compromise
- **File Names:** `cuba.exe`, `vss.ps1` (Shadow copy deletion scripts).
- **Network Indicators:**
- `badiance[.]com`
- `fuller-vision[.]com`
- `193.56.146[.]29`
- **Behavioral Indicators:**
- Execution of `PsExec` for mass deployment across the network.
- PowerShell commands used to delete Volume Shadow Copies (since the ransomware lacks this native function).
- Creation of new firewall rules for RDP (Port 3389).
## Associated Threat Actors
- **Balbesi** (The group primarily attributed to Cuba Ransomware deployments).
## Detection Methods
- **Signature-based detection:** Scanning for Hancitor DLL exports and known Cuba Ransomware file headers.
- **Behavioral detection:** Monitoring for `cmd.exe` or `powershell.exe` spawned from office applications (Word/Excel), and tracking unauthorized `PsExec` usage for lateral movement.
- **YARA Rules:** Target the Hancitor decryption routine and the specific RSA implementation (linked to wolfSSL) found in Cuba Ransomware.
## Mitigation Strategies
- **Email Security:** Disable macros by default via Group Policy and implement rigorous email filtering for suspicious attachments.
- **Endpoint Hardening:** Restrict the use of `PsExec` to authorized administrators only.
- **Network Segmentation:** Disable or strictly control RDP access within the internal network.
- **Backup Integrity:** Maintain offline, immutable backups to counter the deletion of Shadow Copies.
## Related Tools/Techniques
- **Ficker Stealer:** Used for reconnaissance and credential theft.
- **SystemBC:** Used as a persistent proxy and backdoor.
- **Cobalt Strike:** Used for lateral movement and command and control.
- **ProLock:** A ransomware family that shares similar script-based techniques for RDP enablement.