Extracted

• • Target

    help.doc

  • Size

    735KB

  • MD5

    271666888b46008b726d889c40f5e92c

  • SHA1

    5ac08cbdf22aa6a376c51da037aeab03392ee009

  • SHA256

    f6375e696e2e5b3b738346a86a19991eccf89be18e731807114d87fedf77f415

  • SHA512

    af6cc3e91d78c985813484d13eeeaf4026b82c49f4c6536f51f64b25e8702aca01de79db25c2fb37a47af1da51c320d573e03097c243fa6aaac952bed6c7cc16

  Score

  10^/10

  hancitor3101_sjiuwedownloaderpersistence

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2