nworm | 2d89ba4be26780c15328677895a43b6b31791a25105892d562cacf7fc902299d

Analysis

Target

WZQNBDSLVGAWPUXJRUVDYE.ps1
Size

130KB
MD5

3fbbaee606b9fa5ed730aab0c6123ce0
SHA1

a38435566b572cd77b2b5521cf50d830518ba9cf
SHA256

2d89ba4be26780c15328677895a43b6b31791a25105892d562cacf7fc902299d
SHA512

9cb3c6aa7021c09ec5c54520066fea23195e87c5cac41b2eba7bd8a0f31edc23414ebe4bbe3524ebcc2e100c3aec179987e58e11587205d4242302fa92b33f2f

Score

10^/10

Family

nworm

Version

v0.3.8

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057

Mutex

cb2d3cba

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3572 set thread context of 2796	3572	powershell.exe	62

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3572	powershell.exe
3572	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 2796	3572	powershell.exe	62
PID 3572 wrote to memory of 2796	3572	powershell.exe	62
PID 3572 wrote to memory of 2796	3572	powershell.exe	62
PID 3572 wrote to memory of 2796	3572	powershell.exe	62
PID 3572 wrote to memory of 2796	3572	powershell.exe	62
PID 3572 wrote to memory of 2796	3572	powershell.exe	62
PID 3572 wrote to memory of 2796	3572	powershell.exe	62
PID 3572 wrote to memory of 2796	3572	powershell.exe	62

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WZQNBDSLVGAWPUXJRUVDYE.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2796

memory/2796-142-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2796-144-0x000000007500E000-0x000000007500F000-memory.dmp

Filesize
4KB

Download
memory/2796-145-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/2796-146-0x0000000005730000-0x00000000057CC000-memory.dmp

Filesize
624KB

Download
memory/2796-147-0x0000000005D80000-0x0000000006324000-memory.dmp

Filesize
5.6MB

Download
memory/2796-148-0x00000000057D0000-0x0000000005836000-memory.dmp

Filesize
408KB

Download
memory/3572-130-0x00007FFB81073000-0x00007FFB81075000-memory.dmp

Filesize
8KB

Download
memory/3572-135-0x000001E62B510000-0x000001E62B532000-memory.dmp

Filesize
136KB

Download
memory/3572-139-0x000001E62A833000-0x000001E62A835000-memory.dmp

Filesize
8KB

Download
memory/3572-138-0x000001E62A830000-0x000001E62A832000-memory.dmp

Filesize
8KB

Download
memory/3572-140-0x000001E62A836000-0x000001E62A838000-memory.dmp

Filesize
8KB

Download
memory/3572-141-0x000001E62B690000-0x000001E62B6AA000-memory.dmp

Filesize
104KB

Download