Extracted

• • Target
    619efb86dbe1093355df0b76a1da8dc7
  • Size 489KB
  • SHA256 96c5e0009446e8288b6b4a4c48edc19309874cda6e19663fa0c31681d3d078ec
  • MD5 619efb86dbe1093355df0b76a1da8dc7
  • SHA1 536b6876dcb101ad87fb1a09b461ad91516179a4
  • SHA512 18d39f813fa3bb19aee1241eb5c004c70e144856f1931f36e44ee7ebd5847118e6c994016fdf5e408bf5d717a92f6dce1b6384798d8942e5f89ddee5fe4853df
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1309_memqdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2