Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
31-05-2024 14:05
Behavioral task
behavioral1
Sample
NursultanLoader.exe
Resource
win11-20240426-en
General
-
Target
NursultanLoader.exe
-
Size
63KB
-
MD5
3adee1c8284ffa4c948bd53cb4ed8b9e
-
SHA1
15488f0a91896a322ffdc829d9fe2bcb3cfeb319
-
SHA256
61a1e82d71d8b95443c04c37b486b3b56dc9c2931eb10aceb77df00f863be28c
-
SHA512
d9fbe3637219b9b5c53555dbeab64e1c1288acaa4eba727e3e133abf03967b5ea059ae41107ba9960ddd3d629cfca795239baee66b52166ed391d5c81a23924b
-
SSDEEP
1536:N1loX++ZE4J/A/oPXh06NNi+bDvMm4oM6XsVO8Ltxxa:yO+H/BPXh00Q+bDvMHo5sVO8Ls
Malware Config
Extracted
xworm
loss-winners.gl.at.ply.gg:1567
-
Install_directory
%AppData%
-
install_file
Expensive 3.1.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4872-1-0x0000000000190000-0x00000000001A6000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 4676 powershell.exe 2548 powershell.exe 4476 powershell.exe 4800 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NursultanLoader.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\Expensive 3.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Expensive 3.1.exe" NursultanLoader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeNursultanLoader.exepid process 2548 powershell.exe 2548 powershell.exe 4476 powershell.exe 4476 powershell.exe 4800 powershell.exe 4800 powershell.exe 4676 powershell.exe 4676 powershell.exe 4872 NursultanLoader.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
NursultanLoader.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4872 NursultanLoader.exe Token: SeDebugPrivilege 2548 powershell.exe Token: SeDebugPrivilege 4476 powershell.exe Token: SeDebugPrivilege 4800 powershell.exe Token: SeDebugPrivilege 4676 powershell.exe Token: SeDebugPrivilege 4872 NursultanLoader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
NursultanLoader.exepid process 4872 NursultanLoader.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
NursultanLoader.exedescription pid process target process PID 4872 wrote to memory of 2548 4872 NursultanLoader.exe powershell.exe PID 4872 wrote to memory of 2548 4872 NursultanLoader.exe powershell.exe PID 4872 wrote to memory of 4476 4872 NursultanLoader.exe powershell.exe PID 4872 wrote to memory of 4476 4872 NursultanLoader.exe powershell.exe PID 4872 wrote to memory of 4800 4872 NursultanLoader.exe powershell.exe PID 4872 wrote to memory of 4800 4872 NursultanLoader.exe powershell.exe PID 4872 wrote to memory of 4676 4872 NursultanLoader.exe powershell.exe PID 4872 wrote to memory of 4676 4872 NursultanLoader.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe"C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NursultanLoader.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NursultanLoader.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Expensive 3.1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Expensive 3.1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD505b3cd21c1ec02f04caba773186ee8d0
SHA139e790bfe10abf55b74dfb3603df8fcf6b5e6edb
SHA256911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8
SHA512e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb
-
Filesize
944B
MD5050567a067ffea4eb40fe2eefebdc1ee
SHA16e1fb2c7a7976e0724c532449e97722787a00fec
SHA2563952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e
SHA512341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259
-
Filesize
944B
MD5781da0576417bf414dc558e5a315e2be
SHA1215451c1e370be595f1c389f587efeaa93108b4c
SHA25641a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe
SHA51224e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82