Macro -> hancitor->Vawtrak dropper-> Vawtrak DLL

Macro:
->
the pastebin junk
https://www.virustotal.com/en/file/f42608e8d6c614a85c14f423a9acbd902d4d7b54b3c93decf48adea3f1bdf63c/analysis/
downloads:
91.194.254.221 /us1/file.exe
https://www.virustotal.com/en/file/6198efca1df36c2a168f6553dd1adf297562d2cf45da9f03545e4a08f6ed6b41/analysis/

downloads vawtrak from:
http://706.mx /wp-content/plugins/cached_data/us1.exe
https://www.virustotal.com/en/file/3a6f11795fc09ddd1326e939d93399f5a5df283a606e1261db4b79c85b6ba2b8/analysis/
drops vawtrak dll
https://www.virustotal.com/en/file/76ce8052e76d8fdd1214b5eb9b3469f3ff836526e7a63ba112aab752767756e0/analysis/
->
vawtrak c2s:
azmyto.ru
laskrowler.ru
greatcountrygor.ru
firstforestmonth.ru
hornetwart.ru
weronpalace.ru
westnerthgom.ru
dorthgornet.com
fastrevertnom.com
wergilesrest.com
polnerfirst.com
cakedhisjohn.com
idthentehed.com
rebteugrigh.com
othersforrep.com
shumines.com
perundmaheg.ru
dowronrab.ru
fortwronsit.ru
lestrinate.com
withreshersgot.ru
winfertrow.com
quirtenatel.com
masterstargon.ru
natosinhem.ru
withreshersgot.ru 20
uznatus.com
penothec.ru
melebet.ru
fawilut.ru