General
-
Target
0817_4257168362.doc
-
Size
837KB
-
Sample
210818-gcbdzk3t3x
-
MD5
2e6a712f9e3f97617d94ecc36e2a513d
-
SHA1
197641b4c8da57c988031bd8908a0cb11fa18e3d
-
SHA256
f9ec158e6d838e201a3a576daf61ece234a42915822ea2864dcd3ae4576eec93
-
SHA512
a33071e498ab546059559a47b30064142f7bf74fef0c5486746050be03a1d4e9f1f174b57742233bd444518de40f413ed67fae60894ed2514da0bfd63738fc69
Static task
static1
Behavioral task
behavioral1
Sample
0817_4257168362.doc
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0817_4257168362.doc
Resource
win10v20210410
Malware Config
Extracted
hancitor
1608_febd
http://patiennerrhe.com/8/forum.php
http://thougolograrly.ru/8/forum.php
http://chopprousite.ru/8/forum.php
Targets
-
-
Target
0817_4257168362.doc
-
Size
837KB
-
MD5
2e6a712f9e3f97617d94ecc36e2a513d
-
SHA1
197641b4c8da57c988031bd8908a0cb11fa18e3d
-
SHA256
f9ec158e6d838e201a3a576daf61ece234a42915822ea2864dcd3ae4576eec93
-
SHA512
a33071e498ab546059559a47b30064142f7bf74fef0c5486746050be03a1d4e9f1f174b57742233bd444518de40f413ed67fae60894ed2514da0bfd63738fc69
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-