Overview

overview

10

Static

static

8

044805bd45...67.doc

windows7-x64

4

044805bd45...67.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    044805bd45e1bfa0618ad7f0ca651ff691ce7b58e08b1761536aa53d38fc4667

  • Size

    892KB

  • Sample

    240727-zt5b7ssbpa

  • MD5

    eca53d1189d86e35b7567fa2f7b94352

  • SHA1

    692e2c3d905d545ae6688c8982ff3e5b7176c42f

  • SHA256

    044805bd45e1bfa0618ad7f0ca651ff691ce7b58e08b1761536aa53d38fc4667

  • SHA512

    4df485a9bb729c942d87066783f802427d68d161ae73fa1bace752a82b8d2830be5acff22e61bec1cdafa1ff0608d67ad0288adeb31d0a196564c25fef88d417

  • SSDEEP

    24576:kEIZ4wAK74NAx5KxZTBG75gdKtYkzyHxhL:k+wZ74Nx3c75O3WyHx

Score
10/10
hancitordiscoverydownloadermacromacro_on_action

Malware Config

Targets

    • Target

      044805bd45e1bfa0618ad7f0ca651ff691ce7b58e08b1761536aa53d38fc4667

    • Size

      892KB

    • MD5

      eca53d1189d86e35b7567fa2f7b94352

    • SHA1

      692e2c3d905d545ae6688c8982ff3e5b7176c42f

    • SHA256

      044805bd45e1bfa0618ad7f0ca651ff691ce7b58e08b1761536aa53d38fc4667

    • SHA512

      4df485a9bb729c942d87066783f802427d68d161ae73fa1bace752a82b8d2830be5acff22e61bec1cdafa1ff0608d67ad0288adeb31d0a196564c25fef88d417

    • SSDEEP

      24576:kEIZ4wAK74NAx5KxZTBG75gdKtYkzyHxhL:k+wZ74Nx3c75O3WyHx

    Score
    10/10
    discoveryhancitordownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks