Overview

overview

10

Static

static

OHTEYYRNYR...YP.vbs

windows7_x64

10

OHTEYYRNYR...YP.vbs

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    TWG001.iso
  • Size 78KB
  • Sample220127-tk8elsgah3
  • SHA256 386128b90172d3ff50f69382446600ac2703d5a50907c02aac25db73c7be50b1
  • MD5 SHA1 SHA512
Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://15.188.246.78/Q/RILSXDKOPJHN.TXT

Extracted

Family

  • nworm

Version

  • v0.3.8

C2

  • nyanmoney02.duckdns.org:9031

Mutex

  • 2e3fb6d0

Targets

    • Target
      OHTEYYRNYRTUOHCKYTYP.vbs
    • Size 17KB
    • SHA256 1b976a1fa26c4118d09cd6b1eaeceafccc783008c22da58d6f5b1b3019fa1ba4
    • MD5 SHA1 SHA512
    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks