Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2022 15:41
Static task
static1
Behavioral task
behavioral1
Sample
suddenlinkfile08.11.2022.docm
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
suddenlinkfile08.11.2022.docm
Resource
win10v2004-20220721-en
General
-
Target
suddenlinkfile08.11.2022.docm
-
Size
2.3MB
-
MD5
3b6a5f7e4f048cb005496243fe2a019e
-
SHA1
a2f68a276e0b18cb1f11745d9046f4ffa1b1a428
-
SHA256
e9258541a5c96fcacb6a2ce349282db7e9403a16fa9f952e8f1f69929dda7abc
-
SHA512
f8e777ebbf8ef85d0299552f8580adf97af8eb236fd94f998c47417369bebbfeb54882ca34dcd60c9444cc4624fa0f8d8f32c8037abe29dd50a0b6f478c842f1
Malware Config
Extracted
icedid
3570055661
alexbionka.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 49 2352 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
rE45B.tmp.exepid process 1064 rE45B.tmp.exe -
Loads dropped DLL 2 IoCs
Processes:
rE45B.tmp.exerundll32.exepid process 1064 rE45B.tmp.exe 2352 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 492 WINWORD.EXE 492 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2352 rundll32.exe 2352 rundll32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE 492 WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXErE45B.tmp.exedescription pid process target process PID 492 wrote to memory of 1064 492 WINWORD.EXE rE45B.tmp.exe PID 492 wrote to memory of 1064 492 WINWORD.EXE rE45B.tmp.exe PID 492 wrote to memory of 1064 492 WINWORD.EXE rE45B.tmp.exe PID 1064 wrote to memory of 2352 1064 rE45B.tmp.exe rundll32.exe PID 1064 wrote to memory of 2352 1064 rE45B.tmp.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\suddenlinkfile08.11.2022.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rE45B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\rE45B.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\yD120.tmp.dll",#12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Local\Temp\rE45B.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\yD120.tmp.dll",#13⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rE45B.tmp.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
C:\Users\Admin\AppData\Local\Temp\yD120.tmp.dllFilesize
352KB
MD5f45dd73bc0246247ba90020159da9691
SHA16bc3c4849aeb4f349a14f55c744fe8eb20553e4e
SHA25605fab261e9d8d17e1d321b9cee42b512295206d110509d0f8e20127f77e3587a
SHA512de48934326135822851c3c322eef60502d5a252125b9ac06ddf441df74eb32df07fde1d18584ca42f5c022e0a7536d4b5b15ba101521e71c59aa13b86210c63e
-
C:\Users\Admin\AppData\Local\Temp\yD120.tmp.dllFilesize
352KB
MD5f45dd73bc0246247ba90020159da9691
SHA16bc3c4849aeb4f349a14f55c744fe8eb20553e4e
SHA25605fab261e9d8d17e1d321b9cee42b512295206d110509d0f8e20127f77e3587a
SHA512de48934326135822851c3c322eef60502d5a252125b9ac06ddf441df74eb32df07fde1d18584ca42f5c022e0a7536d4b5b15ba101521e71c59aa13b86210c63e
-
C:\Users\Admin\AppData\Local\Temp\yD120.tmp.dllFilesize
352KB
MD5f45dd73bc0246247ba90020159da9691
SHA16bc3c4849aeb4f349a14f55c744fe8eb20553e4e
SHA25605fab261e9d8d17e1d321b9cee42b512295206d110509d0f8e20127f77e3587a
SHA512de48934326135822851c3c322eef60502d5a252125b9ac06ddf441df74eb32df07fde1d18584ca42f5c022e0a7536d4b5b15ba101521e71c59aa13b86210c63e
-
memory/492-134-0x00007FFE65610000-0x00007FFE65620000-memory.dmpFilesize
64KB
-
memory/492-135-0x00007FFE63460000-0x00007FFE63470000-memory.dmpFilesize
64KB
-
memory/492-136-0x00007FFE63460000-0x00007FFE63470000-memory.dmpFilesize
64KB
-
memory/492-137-0x0000018C7856B000-0x0000018C7874E000-memory.dmpFilesize
1.9MB
-
memory/492-138-0x0000018C78190000-0x0000018C78286000-memory.dmpFilesize
984KB
-
memory/492-130-0x00007FFE65610000-0x00007FFE65620000-memory.dmpFilesize
64KB
-
memory/492-133-0x00007FFE65610000-0x00007FFE65620000-memory.dmpFilesize
64KB
-
memory/492-132-0x00007FFE65610000-0x00007FFE65620000-memory.dmpFilesize
64KB
-
memory/492-131-0x00007FFE65610000-0x00007FFE65620000-memory.dmpFilesize
64KB
-
memory/492-145-0x0000018C78190000-0x0000018C78286000-memory.dmpFilesize
984KB
-
memory/1064-139-0x0000000000000000-mapping.dmp
-
memory/2352-143-0x0000000000000000-mapping.dmp
-
memory/2352-146-0x0000000180000000-0x0000000180009000-memory.dmpFilesize
36KB