General
-
Target
kingwoodcable,invoice,09.26.doc
-
Size
866KB
-
Sample
220926-wkqwnscfhn
-
MD5
6ec1488f15f0573d3543e853af6d6e09
-
SHA1
941da2c83cd00abd146d7ef985990933f7f146cb
-
SHA256
cc42ef46da6aaeba9e41b2c5ac494f59383fec47f5736d27d4654613fe4cc610
-
SHA512
448075b3c6f6e92a01557db4c13560ef193087d946469e353e0f5851c9acbca0a3f397b7bdf33eee990b417b39d971e12240911d45b01a71a062e706247960c7
-
SSDEEP
12288:h6VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEW2rlj7REMCyc53:h6V2jUeQRI5wPN//2rlfREMCV
Behavioral task
behavioral1
Sample
kingwoodcable,invoice,09.26.docm
Resource
win7-20220812-en
Malware Config
Extracted
icedid
742081363
scainznorka.com
Targets
-
-
Target
kingwoodcable,invoice,09.26.doc
-
Size
866KB
-
MD5
6ec1488f15f0573d3543e853af6d6e09
-
SHA1
941da2c83cd00abd146d7ef985990933f7f146cb
-
SHA256
cc42ef46da6aaeba9e41b2c5ac494f59383fec47f5736d27d4654613fe4cc610
-
SHA512
448075b3c6f6e92a01557db4c13560ef193087d946469e353e0f5851c9acbca0a3f397b7bdf33eee990b417b39d971e12240911d45b01a71a062e706247960c7
-
SSDEEP
12288:h6VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEW2rlj7REMCyc53:h6V2jUeQRI5wPN//2rlfREMCV
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-