xworm | a722691bd9c2651e1a735f99c85e2b9df02c376eb34ebceddba41c195c28b68b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
08/12/2025, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan.exe
Size 16.0MB
Sample251208-e4rhwa1jfl
SHA256 de01f59d93f3999ef9ece06a45cbd7607a54843c9c9bf015d20191d1a638dc22
MD5 a37cc9b94962a99e6fbc445085a17891
SHA1 22c4eb956a6d4e012f344fb468ca0b4e02315e02
SHA512 9b1b2d6ff35efc02d324da0f3eb9b444753931912a2e0012fd60e8a475b211681a5d19d2d2ef4b0d223f2721beb2bc2dda9cd25b62565d2cfceccb7bae333f78
SSDEEP 393216:EjvCS0jVFoxxr+CF3FM1ornZHvwu0caLJe:EWS0pFoxxDFM4np0Je
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Aytac7771-43366.portmap.host:43366

Mutex

wYZdq9bCrXQvbuJG

Attributes

Install_directory
%LocalAppData%
install_file
Runtime Broker.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000002816b-23.dat	family_xworm
behavioral2/memory/5272-26-0x0000000000F80000-0x0000000000F90000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4992	powershell.exe
1240	powershell.exe
5844	powershell.exe
1156	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1659235647-4126961737-859461056-1000\Control Panel\International\Geo\Nation	Nursultan.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1659235647-4126961737-859461056-1000\Control Panel\International\Geo\Nation	Nurik.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Nurik.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Nurik.exe

Executes dropped EXE 3 IoCs

pid	Process
4572	Nursultan.exe
5272	Nurik.exe
4632	Runtime Broker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1659235647-4126961737-859461056-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Local\\Runtime Broker.exe"	Nurik.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4572	Nursultan.exe
4572	Nursultan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4992	powershell.exe
4992	powershell.exe
1240	powershell.exe
1240	powershell.exe
5844	powershell.exe
5844	powershell.exe
1156	powershell.exe
1156	powershell.exe
5272	Nurik.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5272	Nurik.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeIncreaseQuotaPrivilege	4992	powershell.exe
Token: SeSecurityPrivilege	4992	powershell.exe
Token: SeTakeOwnershipPrivilege	4992	powershell.exe
Token: SeLoadDriverPrivilege	4992	powershell.exe
Token: SeSystemProfilePrivilege	4992	powershell.exe
Token: SeSystemtimePrivilege	4992	powershell.exe
Token: SeProfSingleProcessPrivilege	4992	powershell.exe
Token: SeIncBasePriorityPrivilege	4992	powershell.exe
Token: SeCreatePagefilePrivilege	4992	powershell.exe
Token: SeBackupPrivilege	4992	powershell.exe
Token: SeRestorePrivilege	4992	powershell.exe
Token: SeShutdownPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeSystemEnvironmentPrivilege	4992	powershell.exe
Token: SeRemoteShutdownPrivilege	4992	powershell.exe
Token: SeUndockPrivilege	4992	powershell.exe
Token: SeManageVolumePrivilege	4992	powershell.exe
Token: 33	4992	powershell.exe
Token: 34	4992	powershell.exe
Token: 35	4992	powershell.exe
Token: 36	4992	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeIncreaseQuotaPrivilege	1240	powershell.exe
Token: SeSecurityPrivilege	1240	powershell.exe
Token: SeTakeOwnershipPrivilege	1240	powershell.exe
Token: SeLoadDriverPrivilege	1240	powershell.exe
Token: SeSystemProfilePrivilege	1240	powershell.exe
Token: SeSystemtimePrivilege	1240	powershell.exe
Token: SeProfSingleProcessPrivilege	1240	powershell.exe
Token: SeIncBasePriorityPrivilege	1240	powershell.exe
Token: SeCreatePagefilePrivilege	1240	powershell.exe
Token: SeBackupPrivilege	1240	powershell.exe
Token: SeRestorePrivilege	1240	powershell.exe
Token: SeShutdownPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeSystemEnvironmentPrivilege	1240	powershell.exe
Token: SeRemoteShutdownPrivilege	1240	powershell.exe
Token: SeUndockPrivilege	1240	powershell.exe
Token: SeManageVolumePrivilege	1240	powershell.exe
Token: 33	1240	powershell.exe
Token: 34	1240	powershell.exe
Token: 35	1240	powershell.exe
Token: 36	1240	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeIncreaseQuotaPrivilege	5844	powershell.exe
Token: SeSecurityPrivilege	5844	powershell.exe
Token: SeTakeOwnershipPrivilege	5844	powershell.exe
Token: SeLoadDriverPrivilege	5844	powershell.exe
Token: SeSystemProfilePrivilege	5844	powershell.exe
Token: SeSystemtimePrivilege	5844	powershell.exe
Token: SeProfSingleProcessPrivilege	5844	powershell.exe
Token: SeIncBasePriorityPrivilege	5844	powershell.exe
Token: SeCreatePagefilePrivilege	5844	powershell.exe
Token: SeBackupPrivilege	5844	powershell.exe
Token: SeRestorePrivilege	5844	powershell.exe
Token: SeShutdownPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeSystemEnvironmentPrivilege	5844	powershell.exe
Token: SeRemoteShutdownPrivilege	5844	powershell.exe
Token: SeUndockPrivilege	5844	powershell.exe
Token: SeManageVolumePrivilege	5844	powershell.exe
Token: 33	5844	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5272	Nurik.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4572	4436	Nursultan.exe	79
PID 4436 wrote to memory of 5272	4436	Nursultan.exe	80
PID 5272 wrote to memory of 4992	5272	Nurik.exe	81
PID 5272 wrote to memory of 1240	5272	Nurik.exe	84
PID 5272 wrote to memory of 5844	5272	Nurik.exe	88
PID 5272 wrote to memory of 1156	5272	Nurik.exe	90

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Roaming\Nursultan.exe
  "C:\Users\Admin\AppData\Roaming\Nursultan.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4572
- C:\Users\Admin\AppData\Roaming\Nurik.exe
  "C:\Users\Admin\AppData\Roaming\Nurik.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nurik.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nurik.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1156

C:\Users\Admin\AppData\Local\Runtime Broker.exe
"C:\Users\Admin\AppData\Local\Runtime Broker.exe"
1⤵
- Executes dropped EXE
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0649302c9d6be28f88cdd8224433adfef9faf047f4af0db122f995bb6e1cc176
MD5 46743a6f615302b152e04717c97915f0
SHA1 9840b1ec6da30d2bafdc4fed6c31e897c2bd8bd9
SHA512 90fed4cc5f40bbc908a8df924073eb7b2dab3548b02f0254c228f5cc59a84aed084d509c8499cd7cf707c331e52b6b4f2f5ed92a236acb2709991436b8a5f77c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b08ac14c18515a078ceeb317fffbb7be08c0d5825dde712eb9ad285194b203d2
MD5 6f7eb405e2879fb008dc3a533e6357d3
SHA1 0d99c40ebc8cc86ca4bda593097837a92dc06f57
SHA512 470f3547656ba63513a8cc4ec7e4a5cc765312e394fc7759ca0eadf244ffd23c5491fa39669f2f5d82845a6884936caba6420e4480375af0daf678bad21c9e32
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ac5a19ff1c63a954ffb01b424dc0acd201466df4a23da33602518cfe11d63860
MD5 db7d060719f9d7de5f776f57b90813ee
SHA1 c01908627494af508b42df47723dd3761819eb6a
SHA512 3dde090300589475d84d332eab3e5345a4b4c88da6762ccb022cb2f47e9627b5deee2e6a0b8249d336046288497bdc8ccf772cce22a734dfe213fec03880b98c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_aedsnhd3.pid.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aedsnhd3.pid.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Nurik.exe

Path C:\Users\Admin\AppData\Roaming\Nurik.exe
Size 39KB
SHA256 bb8c81374ac0975a94403e85f21888b561f4b3f04f8174dfbb65aa656d0f57ab
MD5 6eb21a9bb098a808c097e27c992e97dc
SHA1 f0edbdb2b1651c1c5fd7ee86a00d5585490e8e83
SHA512 bf0be936a38f034729e2e0e94d8d306cac10ffd9128f3c47f53500f3645c82eefb32da006c4851467a0f44c7032d5a5b1559aad1fe3c2e2c9fade79cf37dd300
SSDEEP 768:7x/e61/8hsUXQcHlqPmKuufhjrHryT1FWPA9dOfZ16cOMhPaX5:t10hsUgalYmKuu12FL9dg6cOMVc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nursultan.exe

Path C:\Users\Admin\AppData\Roaming\Nursultan.exe
Size 15.9MB
SHA256 b11dcdb51365a6ef1a5292c5e530b5fd56797d3330be5dbe890d68982473c0ba
MD5 88723fc93d21bafee9e5538f16c72a37
SHA1 74363bfb304832c139a8732b06246f49fe50aaa5
SHA512 1c5102e047dd926be666f1422fb04f1f889ad05a47d5d87490bc6cc18848c48816fd5cf7212798af6a95d1c35924744df7e5d75a97ffa82dafa47c80ff88cf23
SSDEEP 393216:k7MOG4esKhrQcRW6ydGldBzr21iLOslPu2do022OaITm:AMOG4evd46ZJOfLDTC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4436-0-0x0000000000830000-0x0000000001842000-memory.dmp

Download

memory/4992-28-0x000001B57E050000-0x000001B57E072000-memory.dmp

Download

memory/5272-26-0x0000000000F80000-0x0000000000F90000-memory.dmp

Download