nworm | 545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

General

Target

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
Size

152KB
MD5

ed2dbd625e5ffd37ba41d4bebde949c9
SHA1

bce1f24f5a3938716df5b1d1da6d0d9052f55efd
SHA256

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778
SHA512

9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Score

10^/10

nworm downloader persistence worm

Malware Config

Extracted

Family

nworm

Version

v0.3.7C

C2

pcinf.myddns.rocks:10000

kqois.ddnsfree.com:10000

Mutex

65372696-a1d2-45d9-b615-d8c9868f84c3

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm
Executes dropped EXE 2 IoCs

Processes:

Windows Update.exeWindows Update.exe

pid process

4704 Windows Update.exe
2988 Windows Update.exe

pid	process
4704	Windows Update.exe
2988	Windows Update.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Control Panel\International\Geo\Nation	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe

Loads dropped DLL 2 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

pid process

2400 545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
4704 Windows Update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update.exe"	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

description	pid	process	target process
PID 2400 set thread context of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 4704 set thread context of 2988	4704	Windows Update.exe	Windows Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

pid	process
2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
4704	Windows Update.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exeWindows Update.exe

description	pid	process
Token: SeDebugPrivilege	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
Token: SeDebugPrivilege	2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
Token: SeDebugPrivilege	4704	Windows Update.exe
Token: SeDebugPrivilege	2988	Windows Update.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exeWindows Update.exe

description	pid	process	target process
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2400 wrote to memory of 2936	2400	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
PID 2936 wrote to memory of 4704	2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 2936 wrote to memory of 4704	2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 2936 wrote to memory of 4704	2936	545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe
PID 4704 wrote to memory of 2988	4704	Windows Update.exe	Windows Update.exe

C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
"C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400

C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe
"C:\Users\Admin\AppData\Local\Temp\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778.exe.log

Filesize
1KB

MD5
c3aa504d1c7765905adabb45cdb8a9ac

SHA1
9e267ff0492927b287a0d14225ade45304bf304d

SHA256
8531e342939d35c6183ee942bdf73298b921e1d6138426f7040aa2774495e8d7

SHA512
546a734104d35610204e3c8e0f080056f53a49f0b4db7824e5c985080b64f403794c1dda897ebb0d659ed3912913cfddab29bd713710159ff77bf68dba2a925a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Update.exe.log

Filesize
1KB

MD5
c3aa504d1c7765905adabb45cdb8a9ac

SHA1
9e267ff0492927b287a0d14225ade45304bf304d

SHA256
8531e342939d35c6183ee942bdf73298b921e1d6138426f7040aa2774495e8d7

SHA512
546a734104d35610204e3c8e0f080056f53a49f0b4db7824e5c985080b64f403794c1dda897ebb0d659ed3912913cfddab29bd713710159ff77bf68dba2a925a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
152KB

MD5
ed2dbd625e5ffd37ba41d4bebde949c9

SHA1
bce1f24f5a3938716df5b1d1da6d0d9052f55efd

SHA256
545d1a7513cca1cd7943f15d5a78990c05b0cd2ec244c58cd15307131ef32778

SHA512
9ece36e7fd34e2b7041d74b0ca34b1821afa53b0f145bd5eb281d13d7f20d42fed779a12b49f046e4952fa29ecbabde69873fe05f0a07ebedfb932db971dc7f2

Download Submit
memory/2400-128-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/2400-124-0x0000000000AD0000-0x0000000000AFC000-memory.dmp

Filesize
176KB

Download
memory/2400-127-0x0000000005DB0000-0x0000000006354000-memory.dmp

Filesize
5.6MB

Download
memory/2400-126-0x0000000073C50000-0x0000000073CD9000-memory.dmp

Filesize
548KB

Download
memory/2936-131-0x0000000004E30000-0x0000000004ECC000-memory.dmp

Filesize
624KB

Download
memory/2936-130-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2936-129-0x0000000000000000-mapping.dmp

Download
memory/2988-139-0x0000000000000000-mapping.dmp

Download
memory/4704-132-0x0000000000000000-mapping.dmp

Download
memory/4704-138-0x0000000073C50000-0x0000000073CD9000-memory.dmp

Filesize
548KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads