Overview

overview

10

Static

static

545d1a7513...78.exe

windows7_x64

10

545d1a7513...78.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

  • Size

    152KB

  • Sample

    220330-da9lxsfad4

  • MD5

    ed2dbd625e5ffd37ba41d4bebde949c9

  • SHA1

    bce1f24f5a3938716df5b1d1da6d0d9052f55efd

  • SHA256

    545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

  • SHA512

    9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Score
10/10
nwormdownloaderpersistenceworm

Malware Config

Extracted

Family

nworm

Version

v0.3.7C

C2

pcinf.myddns.rocks:10000

kqois.ddnsfree.com:10000
Mutex

65372696-a1d2-45d9-b615-d8c9868f84c3

Targets

    • Target

      545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

    • Size

      152KB

    • MD5

      ed2dbd625e5ffd37ba41d4bebde949c9

    • SHA1

      bce1f24f5a3938716df5b1d1da6d0d9052f55efd

    • SHA256

      545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

    • SHA512

      9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

    Score
    10/10
    nwormdownloaderpersistenceworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks