Overview

overview

10

Static

static

8

1027_4844508518.doc

windows7_x64

4

1027_4844508518.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1027_4844508518.doc

  • Size

    417KB

  • Sample

    211027-rzaqsafbc2

  • MD5

    1753470822da12ddd16ddd88b65ecffb

  • SHA1

    475bc8e662d2d52efb5398ec34d0d7bc2f64efe9

  • SHA256

    2e75e7859a6ad5be03ec7c8a894ca901bc708556de1d605ceed5f4e1b8bfd765

  • SHA512

    9d083e51b28fe33c39845436ace5d93f1a8c5818132daaa568e1ca2e7e9b39c0022aad2cd84ad0446c8ed71b9cae582ed032ef5fa445811800495a9fd050275c

Score
10/10
hancitordownloadermacromacro_on_action

Malware Config

Targets

    • Target

      1027_4844508518.doc

    • Size

      417KB

    • MD5

      1753470822da12ddd16ddd88b65ecffb

    • SHA1

      475bc8e662d2d52efb5398ec34d0d7bc2f64efe9

    • SHA256

      2e75e7859a6ad5be03ec7c8a894ca901bc708556de1d605ceed5f4e1b8bfd765

    • SHA512

      9d083e51b28fe33c39845436ace5d93f1a8c5818132daaa568e1ca2e7e9b39c0022aad2cd84ad0446c8ed71b9cae582ed032ef5fa445811800495a9fd050275c

    Score
    10/10
    hancitordownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks