Overview

overview

10

Static

static

ASNQSKJPXJ...YZ.vbs

windows7_x64

10

ASNQSKJPXJ...YZ.vbs

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ASNQSKJPXJLKFXSIEUQYZ.VBS

  • Size

    2KB

  • Sample

    220428-hgxyxsbcb6

  • MD5

    f04ca5c16f111ab69293045badd53ad9

  • SHA1

    1184fafe345b6f79d6a28d87ef957d7f96b76f52

  • SHA256

    00b3ede6f9c3073b02afc09611974bdc4765400ac8c039d620679083b88f63fe

  • SHA512

    f07b185f0b78ff3962767a7f2d85957ca9057ee049fdf90d041bd405dcc23fe2a79c71143fde8b907153942be9525941af7ffc2d9e25f6bf1717cb43990f200b

Score
10/10
nwormdownloaderworm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

hnahmoneu.duckdns.org:6391

Mutex

30896040

Targets

    • Target

      ASNQSKJPXJLKFXSIEUQYZ.VBS

    • Size

      2KB

    • MD5

      f04ca5c16f111ab69293045badd53ad9

    • SHA1

      1184fafe345b6f79d6a28d87ef957d7f96b76f52

    • SHA256

      00b3ede6f9c3073b02afc09611974bdc4765400ac8c039d620679083b88f63fe

    • SHA512

      f07b185f0b78ff3962767a7f2d85957ca9057ee049fdf90d041bd405dcc23fe2a79c71143fde8b907153942be9525941af7ffc2d9e25f6bf1717cb43990f200b

    Score
    10/10
    nwormdownloaderworm

    • NWorm

      A TrickBot module used to propagate to vulnerable domain controllers.

      wormdownloadernworm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks