Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
31-05-2024 14:03
Behavioral task
behavioral1
Sample
NursultanLoader.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
NursultanLoader.exe
Resource
win11-20240426-en
General
-
Target
NursultanLoader.exe
-
Size
63KB
-
MD5
3adee1c8284ffa4c948bd53cb4ed8b9e
-
SHA1
15488f0a91896a322ffdc829d9fe2bcb3cfeb319
-
SHA256
61a1e82d71d8b95443c04c37b486b3b56dc9c2931eb10aceb77df00f863be28c
-
SHA512
d9fbe3637219b9b5c53555dbeab64e1c1288acaa4eba727e3e133abf03967b5ea059ae41107ba9960ddd3d629cfca795239baee66b52166ed391d5c81a23924b
-
SSDEEP
1536:N1loX++ZE4J/A/oPXh06NNi+bDvMm4oM6XsVO8Ltxxa:yO+H/BPXh00Q+bDvMHo5sVO8Ls
Malware Config
Extracted
xworm
loss-winners.gl.at.ply.gg:1567
-
Install_directory
%AppData%
-
install_file
Expensive 3.1.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1716-1-0x0000000000B60000-0x0000000000B76000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3476 powershell.exe 4284 powershell.exe 1132 powershell.exe 4368 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NursultanLoader.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\Expensive 3.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Expensive 3.1.exe" NursultanLoader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeNursultanLoader.exepid process 3476 powershell.exe 3476 powershell.exe 4284 powershell.exe 4284 powershell.exe 1132 powershell.exe 1132 powershell.exe 4368 powershell.exe 4368 powershell.exe 1716 NursultanLoader.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
NursultanLoader.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1716 NursultanLoader.exe Token: SeDebugPrivilege 3476 powershell.exe Token: SeDebugPrivilege 4284 powershell.exe Token: SeDebugPrivilege 1132 powershell.exe Token: SeDebugPrivilege 4368 powershell.exe Token: SeDebugPrivilege 1716 NursultanLoader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
NursultanLoader.exepid process 1716 NursultanLoader.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
NursultanLoader.exedescription pid process target process PID 1716 wrote to memory of 3476 1716 NursultanLoader.exe powershell.exe PID 1716 wrote to memory of 3476 1716 NursultanLoader.exe powershell.exe PID 1716 wrote to memory of 4284 1716 NursultanLoader.exe powershell.exe PID 1716 wrote to memory of 4284 1716 NursultanLoader.exe powershell.exe PID 1716 wrote to memory of 1132 1716 NursultanLoader.exe powershell.exe PID 1716 wrote to memory of 1132 1716 NursultanLoader.exe powershell.exe PID 1716 wrote to memory of 4368 1716 NursultanLoader.exe powershell.exe PID 1716 wrote to memory of 4368 1716 NursultanLoader.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe"C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NursultanLoader.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Expensive 3.1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Expensive 3.1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD52e8eb51096d6f6781456fef7df731d97
SHA1ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA25696bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
SHA5120a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2
-
Filesize
944B
MD54093e5ab3812960039eba1a814c2ffb0
SHA1b5e4a98a80be72fccd3cc910e93113d2febef298
SHA256c0794e2b7036ce5612446a8b15e0c8387773bbc921f63cf8849f8a1f4ef3878c
SHA512f3555b45aa1a1dd5214716dc81a05905c4ecd5a3e1276d35e08c65623ab1d14d469b3b576a5d9638264c1222d73889d2cc1ee43fb579d9ca3fcddd9f557cac7b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82