Analysis
- max time kernel
153s - max time network
143s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/01/2022, 15:33
General
- Target 043c9d3c25c284c582dff2887cc1c92bf1a7c76941d0c2f84eef95d72a31b4a0.exe
- Size 11KB
- Sample220126-szgprsfbb6
- SHA256 043c9d3c25c284c582dff2887cc1c92bf1a7c76941d0c2f84eef95d72a31b4a0
Score
10/10
Malware Config
Extracted
Family
-
nworm
Version
-
v0.3.7C
C2
-
139.180.171.110:2222
Mutex
-
090383e3-d29a-4f22-9ac9-8273a3a0c547
Signatures
- NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\043c9d3c25c284c582dff2887cc1c92bf1a7c76941d0c2f84eef95d72a31b4a0.exe"C:\Users\Admin\AppData\Local\Temp\043c9d3c25c284c582dff2887cc1c92bf1a7c76941d0c2f84eef95d72a31b4a0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4304-115-0x0000000000C00000-0x0000000000C0A000-memory.dmp
memory/4304-116-0x00000000012D0000-0x00000000012D2000-memory.dmp