nworm | 92c51c585672df9fc62a716c9e9e13bd1c5cea22bf0803a98442102af8a9eeea

Analysis

max time kernel
53s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 06:11

Target

ca8aae34beefb29525e8d94c02e00e6f.exe
Size

11KB
MD5

ca8aae34beefb29525e8d94c02e00e6f
SHA1

aaddb87c71e8b39c2635887338614cf055ef6005
SHA256

92c51c585672df9fc62a716c9e9e13bd1c5cea22bf0803a98442102af8a9eeea
SHA512

1383d6a5deafa68666a932250954810fd069ae862cbf2a9fdea6022d32b7bc5a9b381ab8b4734b32c5f5edd753e1a641938e269a58b0c9635d7277b64cd7ce64
SSDEEP

192:bf0bT5u+V0G5j18okX/m5gpEwil94rmuvelyz0w8gxVNa:bMf5u+1jqXPEwq9462Mjw8gLN

Score

10^/10

Family

nworm

Version

v0.3.8

publicvm.camdvr.org:1933

Mutex

9c719311

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ca8aae34beefb29525e8d94c02e00e6f.exe

description pid process

Token: SeDebugPrivilege 2472 ca8aae34beefb29525e8d94c02e00e6f.exe

description	pid	process
Token: SeDebugPrivilege	2472	ca8aae34beefb29525e8d94c02e00e6f.exe

C:\Users\Admin\AppData\Local\Temp\ca8aae34beefb29525e8d94c02e00e6f.exe
"C:\Users\Admin\AppData\Local\Temp\ca8aae34beefb29525e8d94c02e00e6f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

memory/2472-0-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2472-2-0x000000001B060000-0x000000001B070000-memory.dmp

Filesize
64KB

Download
memory/2472-1-0x00007FF877AD0000-0x00007FF878591000-memory.dmp

Filesize
10.8MB

Download
memory/2472-3-0x0000000002590000-0x000000000259A000-memory.dmp

Filesize
40KB

Download
memory/2472-4-0x00007FF877AD0000-0x00007FF878591000-memory.dmp

Filesize
10.8MB

Download
memory/2472-5-0x000000001B060000-0x000000001B070000-memory.dmp

Filesize
64KB

Download