Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 16:46
General
-
Target
Nursultan Leake1d.exe
-
Size
423KB
-
MD5
56b7bf9fd3324fcad106b4951fdb51da
-
SHA1
f15da91511d34268fc24d86184d56b73e9d22f0a
-
SHA256
be29b8bd644e04309f5becd26ee65e3138b50f44090767003b16fd02f428d451
-
SHA512
7a29b4493f7736b1b001cc540568c7bae9a5b604e0ecfa185ffd675053d39014797f37fb74815e10e7891a006a65f076c1a871a2ed715c182c3250d465222092
-
SSDEEP
6144:QzUbeFpDxUC6eVy9QetdHZwJvJMxhnel93mdQoCX:Q5/yIVjAFZwJxEh
Malware Config
Extracted
Family
xworm
C2
content-royal.gl.at.ply.gg:35017
Attributes
-
Install_directory
%AppData%
-
install_file
conhost.exe
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/files/0x000a00000002320a-20.dat family_umbral behavioral1/memory/844-27-0x000002499A810000-0x000002499A850000-memory.dmp family_umbral -
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/5052-0-0x00000000007C0000-0x0000000000830000-memory.dmp family_xworm behavioral1/files/0x0009000000023201-10.dat family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation Nursultan Leake1d.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost.lnk Nursultan Leake1d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost.lnk Nursultan Leake1d.exe -
Executes dropped EXE 3 IoCs
pid Process 4028 conhost.exe 844 nenwoc.exe 3944 conhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe" Nursultan Leake1d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 5052 Nursultan Leake1d.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 5052 Nursultan Leake1d.exe Token: SeDebugPrivilege 5052 Nursultan Leake1d.exe Token: SeDebugPrivilege 4028 conhost.exe Token: SeDebugPrivilege 844 nenwoc.exe Token: SeIncreaseQuotaPrivilege 3780 wmic.exe Token: SeSecurityPrivilege 3780 wmic.exe Token: SeTakeOwnershipPrivilege 3780 wmic.exe Token: SeLoadDriverPrivilege 3780 wmic.exe Token: SeSystemProfilePrivilege 3780 wmic.exe Token: SeSystemtimePrivilege 3780 wmic.exe Token: SeProfSingleProcessPrivilege 3780 wmic.exe Token: SeIncBasePriorityPrivilege 3780 wmic.exe Token: SeCreatePagefilePrivilege 3780 wmic.exe Token: SeBackupPrivilege 3780 wmic.exe Token: SeRestorePrivilege 3780 wmic.exe Token: SeShutdownPrivilege 3780 wmic.exe Token: SeDebugPrivilege 3780 wmic.exe Token: SeSystemEnvironmentPrivilege 3780 wmic.exe Token: SeRemoteShutdownPrivilege 3780 wmic.exe Token: SeUndockPrivilege 3780 wmic.exe Token: SeManageVolumePrivilege 3780 wmic.exe Token: 33 3780 wmic.exe Token: 34 3780 wmic.exe Token: 35 3780 wmic.exe Token: 36 3780 wmic.exe Token: SeIncreaseQuotaPrivilege 3780 wmic.exe Token: SeSecurityPrivilege 3780 wmic.exe Token: SeTakeOwnershipPrivilege 3780 wmic.exe Token: SeLoadDriverPrivilege 3780 wmic.exe Token: SeSystemProfilePrivilege 3780 wmic.exe Token: SeSystemtimePrivilege 3780 wmic.exe Token: SeProfSingleProcessPrivilege 3780 wmic.exe Token: SeIncBasePriorityPrivilege 3780 wmic.exe Token: SeCreatePagefilePrivilege 3780 wmic.exe Token: SeBackupPrivilege 3780 wmic.exe Token: SeRestorePrivilege 3780 wmic.exe Token: SeShutdownPrivilege 3780 wmic.exe Token: SeDebugPrivilege 3780 wmic.exe Token: SeSystemEnvironmentPrivilege 3780 wmic.exe Token: SeRemoteShutdownPrivilege 3780 wmic.exe Token: SeUndockPrivilege 3780 wmic.exe Token: SeManageVolumePrivilege 3780 wmic.exe Token: 33 3780 wmic.exe Token: 34 3780 wmic.exe Token: 35 3780 wmic.exe Token: 36 3780 wmic.exe Token: SeDebugPrivilege 3420 taskmgr.exe Token: SeSystemProfilePrivilege 3420 taskmgr.exe Token: SeCreateGlobalPrivilege 3420 taskmgr.exe Token: SeDebugPrivilege 3944 conhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe 3420 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5052 Nursultan Leake1d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1680 5052 Nursultan Leake1d.exe 94 PID 5052 wrote to memory of 1680 5052 Nursultan Leake1d.exe 94 PID 5052 wrote to memory of 844 5052 Nursultan Leake1d.exe 102 PID 5052 wrote to memory of 844 5052 Nursultan Leake1d.exe 102 PID 844 wrote to memory of 3780 844 nenwoc.exe 103 PID 844 wrote to memory of 3780 844 nenwoc.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan Leake1d.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan Leake1d.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "conhost" /tr "C:\Users\Admin\AppData\Roaming\conhost.exe"2⤵
- Creates scheduled task(s)
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\nenwoc.exe"C:\Users\Admin\AppData\Local\Temp\nenwoc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
-
C:\Users\Admin\AppData\Roaming\conhost.exeC:\Users\Admin\AppData\Roaming\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3420
-
C:\Users\Admin\AppData\Roaming\conhost.exeC:\Users\Admin\AppData\Roaming\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
231KB
MD5f0037b9775e21b6162540672d4ef1285
SHA1f10008d9f78cdf2ab5fd2167a336c04f7e17609d
SHA256e0f17bc30c4ad8b00ac3366dcff94b96ac9c3dba5a388de9f65b729335f5de83
SHA512d6ddd615fb3e9b4ef1615f6e5fdb100e1337b392a8ff97087a88b3dd33cec1ab19fa60b01a9e79d47c124bd941ce30aa99f96018c599a2c8ce7c3cf9faec9b31
-
Filesize
771B
MD5b17328d60d3806151f6460f7bd80e9bc
SHA1a2c2d41b8618cbe0922f9b980135257e4e03ca73
SHA256dcd95dcd6f456047d72f9f280a0938827ae2024007e4d9d8c76874d2aba414cd
SHA512d0e35d4d8c818c51b93c048502468340c8ca03e7e9b30ed4ff47b3332941b86db99b4c79b388cd645e0603fcabe28544d6ce35bc6a6be240c2729486528c141a
-
Filesize
423KB
MD556b7bf9fd3324fcad106b4951fdb51da
SHA1f15da91511d34268fc24d86184d56b73e9d22f0a
SHA256be29b8bd644e04309f5becd26ee65e3138b50f44090767003b16fd02f428d451
SHA5127a29b4493f7736b1b001cc540568c7bae9a5b604e0ecfa185ffd675053d39014797f37fb74815e10e7891a006a65f076c1a871a2ed715c182c3250d465222092