nworm | 545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

General

Target

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
Size

152KB
MD5

ed2dbd625e5ffd37ba41d4bebde949c9
SHA1

bce1f24f5a3938716df5b1d1da6d0d9052f55efd
SHA256

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778
SHA512

9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Score

10^/10

nworm downloader persistence worm

Malware Config

Extracted

Family

nworm

Version

v0.3.7C

C2

pcinf.myddns.rocks:10000

kqois.ddnsfree.com:10000

Mutex

65372696-a1d2-45d9-b615-d8c9868f84c3

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm
Executes dropped EXE 2 IoCs

Processes:

Windows Update.exeWindows Update.exe

pid process

1804 Windows Update.exe
852 Windows Update.exe

pid	process
1804	Windows Update.exe
852	Windows Update.exe

Loads dropped DLL 4 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

pid	process
1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
1804	Windows Update.exe
1804	Windows Update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update.exe"	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

description	pid	process	target process
PID 1356 set thread context of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1804 set thread context of 852	1804	Windows Update.exe	Windows Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

pid	process
1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
1804	Windows Update.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exeWindows Update.exe

description	pid	process
Token: SeDebugPrivilege	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
Token: SeDebugPrivilege	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
Token: SeDebugPrivilege	1804	Windows Update.exe
Token: SeDebugPrivilege	852	Windows Update.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

description	pid	process	target process
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1356 wrote to memory of 1712	1356	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 1712 wrote to memory of 1804	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 1712 wrote to memory of 1804	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 1712 wrote to memory of 1804	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 1712 wrote to memory of 1804	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 1712 wrote to memory of 1804	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 1712 wrote to memory of 1804	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 1712 wrote to memory of 1804	1712	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe
PID 1804 wrote to memory of 852	1804	Windows Update.exe	Windows Update.exe

C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
"C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356

C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
"C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
memory/852-88-0x000000000040474E-mapping.dmp

Download
memory/1356-59-0x0000000001E00000-0x0000000001E0C000-memory.dmp

Filesize
48KB

Download
memory/1356-56-0x00000000003D0000-0x00000000003F6000-memory.dmp

Filesize
152KB

Download
memory/1356-55-0x0000000076291000-0x0000000076293000-memory.dmp

Filesize
8KB

Download
memory/1356-54-0x0000000000810000-0x000000000083C000-memory.dmp

Filesize
176KB

Download
memory/1712-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-66-0x000000000040474E-mapping.dmp

Download
memory/1712-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-64-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-61-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-72-0x0000000000000000-mapping.dmp

Download
memory/1804-75-0x0000000000940000-0x000000000096C000-memory.dmp

Filesize
176KB

Download
memory/1804-77-0x00000000005C0000-0x00000000005E6000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads