Overview

overview

10

Static

static

10

d9e0e8462d...a2.exe

windows7_x64

10

d9e0e8462d...a2.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    26-01-2022 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2.exe

  • Size

    16KB

  • MD5

    a334f17c3c5cd82a43480d74d7cd2f42

  • SHA1

    bb00cbbb1114e7d002c8f03156760ce264160489

  • SHA256

    d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2

  • SHA512

    5a517b19467422b8ff34c973d9b695ab81d175e9e4625825f4c95890f15eae82acff5298fb6a67752c1e1b71d4dbbacad5b155fc248595d151ac0aad9be1520e

Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

34.176.64.245:1234

gamers2020.ownip.net:1234
Mutex

af517389

Signatures

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2.exe
    "C:\Users\Admin\AppData\Local\Temp\d9e0e8462d3d151c5f0179452dfca015d3ea13ca958d5b18abcbbe5d7907a7a2.exe"
    1⤵
      PID:1268

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1268-54-0x0000000000290000-0x000000000029A000-memory.dmp
      Filesize

      40KB

      Download
    • memory/1268-55-0x0000000002000000-0x0000000002002000-memory.dmp
      Filesize

      8KB

      Download