General

  • Target
    0414_1906406106610.doc
  • Size 855KB
  • Sample210414-hmfcg569g2
  • SHA256 2660efbe253523dcaee2e6fdd7da208e084b4ed8cf7e59906a2e3e83a303d087
  • MD5 SHA1 SHA512

Malware Config

Targets

    • Target
      0414_1906406106610.doc
    • Size 855KB
    • SHA256 2660efbe253523dcaee2e6fdd7da208e084b4ed8cf7e59906a2e3e83a303d087
    • MD5 SHA1 SHA512
    Score
    10/10
    • Hancitor

      Hancitor is downloader used to deliver other malware families.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks