General
-
Target
megsinet,invoice,11.30.docm
-
Size
764KB
-
Sample
221130-w8ylesha2v
-
MD5
5e954ef8544a17baf5b56d3bf74ee0f9
-
SHA1
50ee9f5ada3dd34ff0b4e49498af94e0efef789f
-
SHA256
260a5f56868f06efe2a6fb530cb69904f854cced51416ff9c95de2220b563b65
-
SHA512
d143f4dc73b0cb8c38744ea3fba5e933ad3446d455dcdff5ff84e185ec6d64fc3b6a72a03333d47f45103cee9ea7749e9f10ae1039fc2016e85207a4cf9d0c20
-
SSDEEP
12288:/9aRVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE6gNp3PRNKGh/Kt:/CV2jUeQRI5wPN/xgNp3PRNKI/Kt
Behavioral task
behavioral1
Sample
megsinet,invoice,11.30.docm
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
megsinet,invoice,11.30.docm
Resource
win10v2004-20221111-en
Malware Config
Extracted
icedid
1313163077
oilcardirtoz.com
Targets
-
-
Target
megsinet,invoice,11.30.docm
-
Size
764KB
-
MD5
5e954ef8544a17baf5b56d3bf74ee0f9
-
SHA1
50ee9f5ada3dd34ff0b4e49498af94e0efef789f
-
SHA256
260a5f56868f06efe2a6fb530cb69904f854cced51416ff9c95de2220b563b65
-
SHA512
d143f4dc73b0cb8c38744ea3fba5e933ad3446d455dcdff5ff84e185ec6d64fc3b6a72a03333d47f45103cee9ea7749e9f10ae1039fc2016e85207a4cf9d0c20
-
SSDEEP
12288:/9aRVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE6gNp3PRNKGh/Kt:/CV2jUeQRI5wPN/xgNp3PRNKI/Kt
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-