xworm | a722691bd9c2651e1a735f99c85e2b9df02c376eb34ebceddba41c195c28b68b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2025, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan.exe
Size 16.0MB
Sample251208-e4rhwa1jfl
SHA256 de01f59d93f3999ef9ece06a45cbd7607a54843c9c9bf015d20191d1a638dc22
MD5 a37cc9b94962a99e6fbc445085a17891
SHA1 22c4eb956a6d4e012f344fb468ca0b4e02315e02
SHA512 9b1b2d6ff35efc02d324da0f3eb9b444753931912a2e0012fd60e8a475b211681a5d19d2d2ef4b0d223f2721beb2bc2dda9cd25b62565d2cfceccb7bae333f78
SSDEEP 393216:EjvCS0jVFoxxr+CF3FM1ornZHvwu0caLJe:EWS0pFoxxDFM4np0Je
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Aytac7771-43366.portmap.host:43366

Mutex

wYZdq9bCrXQvbuJG

Attributes

Install_directory
%LocalAppData%
install_file
Runtime Broker.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000800000002423a-12.dat	family_xworm
behavioral1/memory/4128-20-0x0000000000B40000-0x0000000000B50000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
3364	powershell.exe
4456	powershell.exe
2940	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1386774604-4769712-761351278-1000\Control Panel\International\Geo\Nation	Nursultan.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1386774604-4769712-761351278-1000\Control Panel\International\Geo\Nation	Nurik.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Nurik.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Nurik.exe

Executes dropped EXE 3 IoCs

pid	Process
5452	Nursultan.exe
4128	Nurik.exe
5176	Runtime Broker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1386774604-4769712-761351278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Local\\Runtime Broker.exe"	Nurik.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5452	Nursultan.exe
5452	Nursultan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
3364	powershell.exe
3364	powershell.exe
4456	powershell.exe
4456	powershell.exe
2940	powershell.exe
2940	powershell.exe
4128	Nurik.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	Nurik.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	4128	Nurik.exe
Token: SeDebugPrivilege	5176	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4128	Nurik.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5356 wrote to memory of 5452	5356	Nursultan.exe	80
PID 5356 wrote to memory of 4128	5356	Nursultan.exe	81
PID 4128 wrote to memory of 4440	4128	Nurik.exe	82
PID 4128 wrote to memory of 3364	4128	Nurik.exe	84
PID 4128 wrote to memory of 4456	4128	Nurik.exe	86
PID 4128 wrote to memory of 2940	4128	Nurik.exe	88

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Users\Admin\AppData\Roaming\Nursultan.exe
  "C:\Users\Admin\AppData\Roaming\Nursultan.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5452
- C:\Users\Admin\AppData\Roaming\Nurik.exe
  "C:\Users\Admin\AppData\Roaming\Nurik.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nurik.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nurik.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2940

C:\Users\Admin\AppData\Local\Runtime Broker.exe
"C:\Users\Admin\AppData\Local\Runtime Broker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 16c05848744983bd75fe403c1aa3aded96c6baf10b77fe95d9f4b52d8422daac
MD5 51fc9f46ed7a5fbec980d47049731eac
SHA1 1811612998c800bb4563742c4760b2ab3a5e2677
SHA512 e55ea8fe57f30d236b3ba8cd327e53dac090bb71ef7899b536a4acccd997a6aa232d9b80e0995a536975aeb13cfe29eda27b630393683e3825660224d96b8a15
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
MD5 eb1ad317bd25b55b2bbdce8a28a74a94
SHA1 98a3978be4d10d62e7411946474579ee5bdc5ea6
SHA512 d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e6254c2bc9846a76a4567ab91b6eae76e937307ff9301b65d577ffe6e15fe40a
MD5 47605a4dda32c9dff09a9ca441417339
SHA1 4f68c895c35b0dc36257fc8251e70b968c560b62
SHA512 b6823b6e794a2fe3e4c4ecfb3f0d61a54821de7feb4f9e3e7fd463e7fbb5e6848f59865b487dafebeac431e4f4db81ef56836d94cac67da39852c566ed34a885
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_mochwnc2.50q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mochwnc2.50q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Nurik.exe

Path C:\Users\Admin\AppData\Roaming\Nurik.exe
Size 39KB
SHA256 bb8c81374ac0975a94403e85f21888b561f4b3f04f8174dfbb65aa656d0f57ab
MD5 6eb21a9bb098a808c097e27c992e97dc
SHA1 f0edbdb2b1651c1c5fd7ee86a00d5585490e8e83
SHA512 bf0be936a38f034729e2e0e94d8d306cac10ffd9128f3c47f53500f3645c82eefb32da006c4851467a0f44c7032d5a5b1559aad1fe3c2e2c9fade79cf37dd300
SSDEEP 768:7x/e61/8hsUXQcHlqPmKuufhjrHryT1FWPA9dOfZ16cOMhPaX5:t10hsUgalYmKuu12FL9dg6cOMVc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nursultan.exe

Path C:\Users\Admin\AppData\Roaming\Nursultan.exe
Size 15.9MB
SHA256 b11dcdb51365a6ef1a5292c5e530b5fd56797d3330be5dbe890d68982473c0ba
MD5 88723fc93d21bafee9e5538f16c72a37
SHA1 74363bfb304832c139a8732b06246f49fe50aaa5
SHA512 1c5102e047dd926be666f1422fb04f1f889ad05a47d5d87490bc6cc18848c48816fd5cf7212798af6a95d1c35924744df7e5d75a97ffa82dafa47c80ff88cf23
SSDEEP 393216:k7MOG4esKhrQcRW6ydGldBzr21iLOslPu2do022OaITm:AMOG4evd46ZJOfLDTC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4128-20-0x0000000000B40000-0x0000000000B50000-memory.dmp

Download

memory/4440-29-0x000002B89EAA0000-0x000002B89EAC2000-memory.dmp

Download

memory/5356-0-0x00000000001B0000-0x00000000011C2000-memory.dmp

Download