nworm | 6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5

Analysis

max time kernel
151s
max time network
160s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe
Size 17KB
Sample220126-sznhbafbc8
SHA256 6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5
MD5 a732681cf43faa2686e04c2898e7c0a5
SHA1 832a5a868ca589f2d912c6ea180e3c72fc6a55fa
SHA512 b64d84d32c2b507db281a82c2c69c5ba587cbc48cc2f5fb0128411fe0ae5adfece33fcb095ff8de7984f2bcd650b54471e86348463b4ebbce9f15bac5e292b7f
MD5 SHA1 SHA512

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

jhonjhon4842.ddns.net:2202

Mutex

0e7ff83a

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm

Executes dropped EXE 1 IoCs

pid	Process
3384	avasts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2180	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3584	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2180	2712	6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe	69
PID 2712 wrote to memory of 2180	2712	6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe	69
PID 2712 wrote to memory of 3576	2712	6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe	71
PID 2712 wrote to memory of 3576	2712	6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe	71
PID 3576 wrote to memory of 3584	3576	cmd.exe	73
PID 3576 wrote to memory of 3584	3576	cmd.exe	73
PID 3576 wrote to memory of 3384	3576	cmd.exe	74
PID 3576 wrote to memory of 3384	3576	cmd.exe	74

C:\Users\Admin\AppData\Local\Temp\6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe
"C:\Users\Admin\AppData\Local\Temp\6ae51c73fe90276910aaec559e898d76f0183b9f766d7acc7fc3236afa7cb3a5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'avasts.exe"' /tr "'C:\Users\Admin\AppData\Roaming\avasts.exe"'
  2⤵
  - Creates scheduled task(s)
  PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3AA4.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3584
- - C:\Users\Admin\AppData\Roaming\avasts.exe
    "C:\Users\Admin\AppData\Roaming\avasts.exe"
    3⤵
    - Executes dropped EXE
    PID:3384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-118-0x00000000005C0000-0x00000000005CA000-memory.dmp

Download

memory/3384-122-0x000000001B210000-0x000000001B212000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads