Overview

overview

10

Static

static

10

6eccc9b1ec...9c.exe

windows7_x64

10

6eccc9b1ec...9c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6eccc9b1ec733f8e229e2b523942c8947208da6625f251f64e10680228f42f9c.bin
  • Size 17KB
  • Sample220126-szn4vafbd2
  • SHA256 6eccc9b1ec733f8e229e2b523942c8947208da6625f251f64e10680228f42f9c
  • MD5 SHA1 SHA512
Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

  • nworm

Version

  • v0.3.8

C2

  • updateservice.linkpc.net:81

  • ainda.dyndns.org:81

Mutex

  • debff03b

Targets

    • Target
      6eccc9b1ec733f8e229e2b523942c8947208da6625f251f64e10680228f42f9c.bin
    • Size 17KB
    • SHA256 6eccc9b1ec733f8e229e2b523942c8947208da6625f251f64e10680228f42f9c
    • MD5 SHA1 SHA512
    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks