Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 10:20
Static task
static1
Behavioral task
behavioral1
Sample
16c23beea2ed64892ae33e3214dcd22e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
16c23beea2ed64892ae33e3214dcd22e.exe
Resource
win10v2004-20231215-en
General
-
Target
16c23beea2ed64892ae33e3214dcd22e.exe
-
Size
22KB
-
MD5
16c23beea2ed64892ae33e3214dcd22e
-
SHA1
dc3a74fb3723160a2b80fd7adb6cc006b84f3c04
-
SHA256
0821ca98c306c5ac791e7fb80d81e5f8dc7d49f3bd88935561c1bc0d70821674
-
SHA512
cda51458e2f038ed8e03af4dad324866428f439b086ba7d5bd6f843d6d0aa91fa5294ccde00d7bbd331c5242ffec5bdf8f5b17c0594bbe4bcd3e0378145ff8dd
-
SSDEEP
384:I9azLT4M+GdozOWeLYRJkE6SesUynJ8Y/TISQk:IDM+GdozOWeLYR+EJPqYrz
Malware Config
Extracted
nworm
v0.3.8
publicvm.camdvr.org:1933
9c719311
Signatures
-
NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
16c23beea2ed64892ae33e3214dcd22e.exedescription pid process Token: SeDebugPrivilege 4696 16c23beea2ed64892ae33e3214dcd22e.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4696-0-0x0000000000A40000-0x0000000000A4C000-memory.dmpFilesize
48KB
-
memory/4696-1-0x00007FFC72850000-0x00007FFC73311000-memory.dmpFilesize
10.8MB
-
memory/4696-2-0x000000001B660000-0x000000001B670000-memory.dmpFilesize
64KB
-
memory/4696-3-0x0000000001230000-0x000000000123A000-memory.dmpFilesize
40KB
-
memory/4696-4-0x00007FFC72850000-0x00007FFC73311000-memory.dmpFilesize
10.8MB
-
memory/4696-5-0x000000001B660000-0x000000001B670000-memory.dmpFilesize
64KB