Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
-
submitted
05/03/2025, 06:30
General
-
Target
NursultanInstaller.exe
-
Size
65KB
-
MD5
e68a1f37e2d6dfa0f872fa3686c191b6
-
SHA1
37b7cd6008897f8f1505476831920c4ba70d4dd6
-
SHA256
0d5b834411c554bfc9c847d98a1f821a340498db83eff0d8c53c2591e2a74927
-
SHA512
4dd80c907d191c24830f50747e6d553a43e8160cffb036d0e7a39c50255ca29eba17f68a3a42e3f2dbad9d45431dfc4acfdbbcb17ea6d84df5de84a356496aba
-
SSDEEP
1536:sV9kuY/lp2pq1PQj24Ibl/imCWMwY7I6lvFGOkAiZv:cw72pq1oybl/DH98nvcO7iZv
Score
10/10
Malware Config
Extracted
Family
xworm
C2
teachers-caught.gl.at.ply.gg:19879
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NursultanInstaller.exe"C:\Users\Admin\AppData\Local\Temp\NursultanInstaller.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB