nworm | 5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd

Analysis

max time kernel
154s
max time network
154s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe
Size 17KB
Sample220126-szl99afbc5
SHA256 5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd
MD5 16ce8ee04799a1e4f531eec98418a994
SHA1 cda1ba9604872a6f462a21f6b82b2ca643b81b76
SHA512 dcb4486d0a9fc66b0bf71083e3f79950d3f163bf74526c862dc7b8717d26829d3e04715eaa566db8ecd46cc778839efef8a9d9da090e7f90f8301869d79dc289
MD5 SHA1 SHA512

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

jtbz.ddns.net:1604
jtbz2.ddns.net:1604

Mutex

2f5c1f29

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm

Executes dropped EXE 1 IoCs

pid	Process
840	windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2764	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3944	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	796	5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2764	796	5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe	70
PID 796 wrote to memory of 2764	796	5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe	70
PID 796 wrote to memory of 1884	796	5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe	71
PID 796 wrote to memory of 1884	796	5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe	71
PID 1884 wrote to memory of 3944	1884	cmd.exe	73
PID 1884 wrote to memory of 3944	1884	cmd.exe	73
PID 1884 wrote to memory of 840	1884	cmd.exe	76
PID 1884 wrote to memory of 840	1884	cmd.exe	76

C:\Users\Admin\AppData\Local\Temp\5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe
"C:\Users\Admin\AppData\Local\Temp\5934d1da5cf45739ab3c3c01c8fe736a4aeac541b1b9601efe4d1eea6d2fcecd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'windows.exe"' /tr "'C:\Users\Admin\AppData\Roaming\windows.exe"'
  2⤵
  - Creates scheduled task(s)
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD250.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3944
- - C:\Users\Admin\AppData\Roaming\windows.exe
    "C:\Users\Admin\AppData\Roaming\windows.exe"
    3⤵
    - Executes dropped EXE
    PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-115-0x0000000000590000-0x000000000059A000-memory.dmp

Download

memory/840-119-0x000000001AEB0000-0x000000001AEB2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads