Overview

overview

10

Static

static

10

Y7839.ps1

windows7_x64

1

Y7839.ps1

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Y7839.ps1

  • Size

    55KB

  • Sample

    220210-vxkprahbc2

  • MD5

    e2201063031968eddf2e02dfe7aeae82

  • SHA1

    0dc6b5dbf9225f4a20e38fc3f7664da72ca1a21f

  • SHA256

    d074c74b09cb7d64c8647b8da0adeea4293db6abd5d0ae4202cef511252acf1b

  • SHA512

    e3fff0b87345e2c5179b9c075d22bacb85a64ddd48968510e37cfb621a0220826c50b864680a78f3fe97c55873c3bb6d6be141ba6ef29d9bcff34136d8c5d3ea

Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://54.235.58.2/3/ServR43.txt

Extracted

Family

nworm

Version

v0.3.8

C2

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057
Mutex

cb2d3cba

Targets

    • Target

      Y7839.ps1

    • Size

      55KB

    • MD5

      e2201063031968eddf2e02dfe7aeae82

    • SHA1

      0dc6b5dbf9225f4a20e38fc3f7664da72ca1a21f

    • SHA256

      d074c74b09cb7d64c8647b8da0adeea4293db6abd5d0ae4202cef511252acf1b

    • SHA512

      e3fff0b87345e2c5179b9c075d22bacb85a64ddd48968510e37cfb621a0220826c50b864680a78f3fe97c55873c3bb6d6be141ba6ef29d9bcff34136d8c5d3ea

    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks