Overview

overview

10

Static

static

10

162be825ad...1d.exe

windows7_x64

10

162be825ad...1d.exe

windows10_x64

10

Analysis

  • max time kernel
    159s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    26-01-2022 14:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    162be825adc37d92d3d43d15b6bf960f67d0aab3fa6e854034f396074582ff1d.exe

  • Size

    17KB

  • MD5

    387d598af1ab8e2f3c611d5df5e4c441

  • SHA1

    9bdee4fe605b4a35c923c53530ccb2eda98f3e09

  • SHA256

    162be825adc37d92d3d43d15b6bf960f67d0aab3fa6e854034f396074582ff1d

  • SHA512

    c32298a93be95e8c112d8bd49222df8b79530e25e198f8df8c2f8834b2d9a745cab9c982c8f239293ea373c71fbe22e179c5ab9091ba9a66917a28dd1c6dd7a6

Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

127.0.0.1:1133

Mutex

d6918d59

Signatures

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\162be825adc37d92d3d43d15b6bf960f67d0aab3fa6e854034f396074582ff1d.exe
    "C:\Users\Admin\AppData\Local\Temp\162be825adc37d92d3d43d15b6bf960f67d0aab3fa6e854034f396074582ff1d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1756-54-0x0000000000E10000-0x0000000000E1A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1756-55-0x00000000009B0000-0x00000000009B2000-memory.dmp
    Filesize

    8KB

    Download