Overview

overview

10

Static

static

10

f77109af13...59.exe

windows7_x64

10

f77109af13...59.exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    26/01/2022, 14:54 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe

  • Size

    16KB

  • MD5

    f675e34b7abaf8a70c63be696a419601

  • SHA1

    4856dc2b652b49d3fc7fcc733f45d7682ae06c27

  • SHA256

    f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859

  • SHA512

    f17146bb4044ceb8148c4703da804652891cc9fd883e9611822355b77c2900be3f43aa293532df513623ef46e14970be2803d66fd394b2e6f176a58e945c5c3c

Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

nyanworm.duckdns.org:6079

Mutex

c27886df

Signatures

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

Processes

  • C:\Users\Admin\AppData\Local\Temp\f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
    "C:\Users\Admin\AppData\Local\Temp\f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe"
    1⤵
      PID:1452

    Network

    • flag-us
      DNS
      nyanworm.duckdns.org
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      Remote address:
      8.8.8.8:53
      Request
      nyanworm.duckdns.org
      IN A
      Response
      nyanworm.duckdns.org
      IN A
      31.42.186.121
    • flag-us
      DNS
      nyanworm.duckdns.org
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      Remote address:
      8.8.8.8:53
      Request
      nyanworm.duckdns.org
      IN A
      Response
      nyanworm.duckdns.org
      IN A
      31.42.186.121
    • flag-us
      DNS
      nyanworm.duckdns.org
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      Remote address:
      8.8.8.8:53
      Request
      nyanworm.duckdns.org
      IN A
      Response
      nyanworm.duckdns.org
      IN A
      31.42.186.121
    • 31.42.186.121:6079
      nyanworm.duckdns.org
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      304 B
       6
    • 31.42.186.121:6079
      nyanworm.duckdns.org
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      304 B
       6
    • 31.42.186.121:6079
      nyanworm.duckdns.org
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      304 B
       6
    • 31.42.186.121:6079
      nyanworm.duckdns.org
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      104 B
       2
    • 8.8.8.8:53
      nyanworm.duckdns.org
      dns
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      66 B
       82 B
       1
      1

      DNS Request

      nyanworm.duckdns.org

      DNS Response

      31.42.186.121

    • 8.8.8.8:53
      nyanworm.duckdns.org
      dns
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      66 B
       82 B
       1
      1

      DNS Request

      nyanworm.duckdns.org

      DNS Response

      31.42.186.121

    • 8.8.8.8:53
      nyanworm.duckdns.org
      dns
      f77109af1314a10e1760861e682c570515aa395092c580b9127701095b1d5859.exe
      66 B
       82 B
       1
      1

      DNS Request

      nyanworm.duckdns.org

      DNS Response

      31.42.186.121

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1452-54-0x0000000000FA0000-0x0000000000FAA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1452-55-0x000000001AE00000-0x000000001AE02000-memory.dmp

      Filesize

      8KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.