{
  "family": "chanitor",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Trojan:Win32/Chanitor (also widely tracked as **Hancitor**) is a notorious, highly active trojan downloader. Its sole purpose is to serve as the initial infection vector, bypassing endpoint security to secretly download and install highly destructive secondary payloads, most commonly major ransomware families (like Cuba or Egregor) and advanced information stealers (like FickerStealer or Pony).<br><br><b>Understanding Chanitor (Hancitor Downloader)</b><br>To an end-user, Chanitor execution often looks like a failed attempt to open a document. For a security analyst, a Chanitor infection is a critical, time-sensitive emergency. It is an 'Initial Access Broker' tool. If Chanitor is detected, it is almost certain that a severe ransomware deployment or data exfiltration event is imminent if the C2 communication is not severed immediately.<br><br><b>Execution and Evasion Strategies</b><br>Chanitor is distributed via massive, high-volume malspam campaigns (`T1566.001`), often using DocuSign, invoice, or fax themes. The attached Word documents contain malicious macros (`T1059.005`) that, when enabled by the user, extract the Chanitor DLL and execute it using `rundll32.exe` (`T1218.011`). Once running in memory, Chanitor profiles the system and immediately initiates encrypted communications (often HTTPS or custom protocols) with its C2 infrastructure (`T1105`) to fetch the next-stage payloads. It frequently utilizes Process Injection (`T1055`) to hide its downloading activity inside legitimate Windows processes like `svchost.exe`.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include `WINWORD.EXE` spawning suspicious child processes, particularly `rundll32.exe` executing a randomly named DLL from the `%AppData%` or `%Temp%` directories. Network IoCs are critical: look for outbound connections to hardcoded, often newly registered, C2 IP addresses. The presence of secondary payloads (like Cobalt Strike beacons or known ransomware encryptors) is the ultimate, albeit late, IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1055",
    "T1218.011",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1218.011",
      "name": "System Binary Proxy Execution: Rundll32",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading ransomware/beacons)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "ISOLATE THE ENDPOINT IMMEDIATELY. The primary goal is to sever Chanitor's connection to its C2 server before the ransomware payload is downloaded.",
    "Identify the C2 IPs/domains contacted by Chanitor via EDR or network logs and block them enterprise-wide.",
    "If the connection was successful, assume the endpoint is fully compromised, begin hunting for Cobalt Strike beacons, and prepare for a ransomware response.",
    "Capture a memory dump before wiping the machine to extract the injected payloads and identify the ultimate threat actor."
  ],
  "what_to_avoid": [
    "Do not assume the incident is resolved just because AV quarantined the initial Word document; you must verify if `rundll32.exe` executed.",
    "Avoid leaving the machine on the network while investigating; Chanitor acts extremely fast to deploy secondary payloads."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}