Analysis
-
max time kernel
167s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 11:06
General
-
Target
16c23beea2ed64892ae33e3214dcd22e.exe
-
Size
22KB
-
MD5
16c23beea2ed64892ae33e3214dcd22e
-
SHA1
dc3a74fb3723160a2b80fd7adb6cc006b84f3c04
-
SHA256
0821ca98c306c5ac791e7fb80d81e5f8dc7d49f3bd88935561c1bc0d70821674
-
SHA512
cda51458e2f038ed8e03af4dad324866428f439b086ba7d5bd6f843d6d0aa91fa5294ccde00d7bbd331c5242ffec5bdf8f5b17c0594bbe4bcd3e0378145ff8dd
-
SSDEEP
384:I9azLT4M+GdozOWeLYRJkE6SesUynJ8Y/TISQk:IDM+GdozOWeLYR+EJPqYrz
Score
10/10
Malware Config
Extracted
Family
nworm
Version
v0.3.8
C2
publicvm.camdvr.org:1933
Mutex
9c719311
Signatures
-
NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c23beea2ed64892ae33e3214dcd22e.exe"C:\Users\Admin\AppData\Local\Temp\16c23beea2ed64892ae33e3214dcd22e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-0-0x0000000000AF0000-0x0000000000AFC000-memory.dmpFilesize
48KB
-
memory/532-1-0x00007FFE5A3F0000-0x00007FFE5AEB1000-memory.dmpFilesize
10.8MB
-
memory/532-2-0x00000000012A0000-0x00000000012B0000-memory.dmpFilesize
64KB
-
memory/532-3-0x00000000012F0000-0x00000000012FA000-memory.dmpFilesize
40KB
-
memory/532-4-0x00007FFE5A3F0000-0x00007FFE5AEB1000-memory.dmpFilesize
10.8MB
-
memory/532-5-0x00000000012A0000-0x00000000012B0000-memory.dmpFilesize
64KB