nworm | 34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f

Analysis

max time kernel
137s
max time network
149s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe
Size 83KB
Sample220126-szj5wsfbc2
SHA256 34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f
MD5 972a4f69140dd4785c051d5e82937404
SHA1 5792f489d1337f21b4783aa9d87dd664f4b662bc
SHA512 39fb7b873c325cc7e4a5a73ec9383e8ff604c649a2b1e3dbb410e63d6c66e44a37568e6b9ff475d05b4133cad1c95a246ce831a2075f79189921536c9ea93a6c
MD5 SHA1 SHA512

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

narotomagic.publicvm.com:1170

Mutex

c31d7883

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm

Executes dropped EXE 1 IoCs

pid	Process
4368	SANTOK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4268	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4380	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4268	3652	34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe	69
PID 3652 wrote to memory of 4268	3652	34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe	69
PID 3652 wrote to memory of 4384	3652	34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe	71
PID 3652 wrote to memory of 4384	3652	34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe	71
PID 4384 wrote to memory of 4380	4384	cmd.exe	73
PID 4384 wrote to memory of 4380	4384	cmd.exe	73
PID 4384 wrote to memory of 4368	4384	cmd.exe	74
PID 4384 wrote to memory of 4368	4384	cmd.exe	74

C:\Users\Admin\AppData\Local\Temp\34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe
"C:\Users\Admin\AppData\Local\Temp\34a01c5a55d7f77a53d694af2dcd284b259530a34a3ac8caa279cccc4959710f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'SANTOK.exe"' /tr "'C:\Users\Admin\AppData\Roaming\SANTOK.exe"'
  2⤵
  - Creates scheduled task(s)
  PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1818.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4380
- - C:\Users\Admin\AppData\Roaming\SANTOK.exe
    "C:\Users\Admin\AppData\Roaming\SANTOK.exe"
    3⤵
    - Executes dropped EXE
    PID:4368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3652-115-0x0000000000820000-0x000000000083A000-memory.dmp

Download

memory/4368-119-0x000000001B280000-0x000000001B282000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads