Extracted

• • Target
    8c85a65a764bc1e9e30bc0f7e7cf90bc
  • Size 489KB
  • SHA256 afcbaa63e0ba15a5acb7b62cf52f78044c121edd208749081f47a45fee5fe408
  • MD5 8c85a65a764bc1e9e30bc0f7e7cf90bc
  • SHA1 d8d92911a6dbb7fe8b63c3bf8e30230392a2d250
  • SHA512 040d091b14fefe39d0a7a288712b1c20c3c00c14b815d5a384850627d727dbd18f6cac34465049c2ad1f4cdc8cd82ed6248f8b0e555747514e617c95527e83f6
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1309_memqdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2