General

  • Target

    file

  • Size

    901KB

  • Sample

    210706-r6k4zz2wva

  • MD5

    cd7e2ac74f739efc610a4f0849d61825

  • SHA1

    e13d9c0482baa3b7712119de56a40b1dedbb9f28

  • SHA256

    6fd21392a247d3f5cc83de50e1006010c438b609158ac5e7b6408627fdd4aa0b

  • SHA512

    5b4379009ed238289294b26189d42ff123778b0d953c4f98c5ada33f7a0c23b6bceb8a62617815a938574430779020f8c28b617d0f4997631c7afd39a61f8fc4

Malware Config

Targets

    • Target

      file

    • Size

      901KB

    • MD5

      cd7e2ac74f739efc610a4f0849d61825

    • SHA1

      e13d9c0482baa3b7712119de56a40b1dedbb9f28

    • SHA256

      6fd21392a247d3f5cc83de50e1006010c438b609158ac5e7b6408627fdd4aa0b

    • SHA512

      5b4379009ed238289294b26189d42ff123778b0d953c4f98c5ada33f7a0c23b6bceb8a62617815a938574430779020f8c28b617d0f4997631c7afd39a61f8fc4

    Score
    10/10
    • Hancitor

      Hancitor is downloader used to deliver other malware families.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks