Overview

overview

10

Static

static

10

34a01c5a55...0f.exe

windows7_x64

10

34a01c5a55...0f.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.bin
  • Size 83KB
  • Sample220126-szj5wsfbc2
  • SHA256 34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f
  • MD5 SHA1 SHA512
Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

  • nworm

Version

  • v0.3.8

C2

  • narotomagic.publicvm.com:1170

Mutex

  • c31d7883

Targets

    • Target
      34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.bin
    • Size 83KB
    • SHA256 34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f
    • MD5 SHA1 SHA512
    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks