Extracted

• • Target
    857a1edbd09a8456aac3fd9cd492b6db
  • Size 489KB
  • SHA256 c5a7350ba5d5fed56834a15b4942da31ed7534dd34bd989de4eebadb27d11b5f
  • MD5 857a1edbd09a8456aac3fd9cd492b6db
  • SHA1 b9f48c7b0878e6e0518668e5786e4821d01d8aaf
  • SHA512 07ff67c4e12d153c9647019e9f82ce41383acd3a9d1f1eb28473b01f914f6bc512c61b8c24108082e300c9f75678020fdd4874e9abbdb4ca00116a71a6524f8f
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1309_memqdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2