Extracted

• • Target

    545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

  • Size

    152KB

  • MD5

    ed2dbd625e5ffd37ba41d4bebde949c9

  • SHA1

    bce1f24f5a3938716df5b1d1da6d0d9052f55efd

  • SHA256

    545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

  • SHA512

    9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

  Score

  10^/10

  nwormdownloaderpersistenceworm

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2