Overview

overview

10

Static

static

8

e88b804939...e6.doc

windows7-x64

4

e88b804939...e6.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e88b8049397c21d470396692ef208d696364e36e556690297779cf68e311a9e6

  • Size

    893KB

  • Sample

    240728-14vfessblc

  • MD5

    32248c17f968e76bbe8b90ea3be8f6f9

  • SHA1

    0d5318656d07f6a071b2ca3db6a96da387873941

  • SHA256

    e88b8049397c21d470396692ef208d696364e36e556690297779cf68e311a9e6

  • SHA512

    92213947b957c90aecf00df21b795018a174aa1aab38d42c4e8b93124429adc7ce1d599698834805103fd7c6f2a6bae0700305c3a692a43e1a9c74950137947b

  • SSDEEP

    24576:jEIZ4wAK74NAx5KxZTBG75gdLtYkzyHtSD:j+wZ74Nx3c75OyWyHt

Score
10/10
hancitordiscoverydownloadermacromacro_on_action

Malware Config

Targets

    • Target

      e88b8049397c21d470396692ef208d696364e36e556690297779cf68e311a9e6

    • Size

      893KB

    • MD5

      32248c17f968e76bbe8b90ea3be8f6f9

    • SHA1

      0d5318656d07f6a071b2ca3db6a96da387873941

    • SHA256

      e88b8049397c21d470396692ef208d696364e36e556690297779cf68e311a9e6

    • SHA512

      92213947b957c90aecf00df21b795018a174aa1aab38d42c4e8b93124429adc7ce1d599698834805103fd7c6f2a6bae0700305c3a692a43e1a9c74950137947b

    • SSDEEP

      24576:jEIZ4wAK74NAx5KxZTBG75gdLtYkzyHtSD:j+wZ74Nx3c75OyWyHt

    Score
    10/10
    discoveryhancitordownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks