xworm | a722691bd9c2651e1a735f99c85e2b9df02c376eb34ebceddba41c195c28b68b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
08/12/2025, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan.exe
Size 16.0MB
Sample251208-e4rhwa1jfl
SHA256 de01f59d93f3999ef9ece06a45cbd7607a54843c9c9bf015d20191d1a638dc22
MD5 a37cc9b94962a99e6fbc445085a17891
SHA1 22c4eb956a6d4e012f344fb468ca0b4e02315e02
SHA512 9b1b2d6ff35efc02d324da0f3eb9b444753931912a2e0012fd60e8a475b211681a5d19d2d2ef4b0d223f2721beb2bc2dda9cd25b62565d2cfceccb7bae333f78
SSDEEP 393216:EjvCS0jVFoxxr+CF3FM1ornZHvwu0caLJe:EWS0pFoxxDFM4np0Je
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Aytac7771-43366.portmap.host:43366

Mutex

wYZdq9bCrXQvbuJG

Attributes

Install_directory
%LocalAppData%
install_file
Runtime Broker.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/files/0x001a00000002b0e0-17.dat	family_xworm
behavioral3/memory/4480-20-0x00000000002C0000-0x00000000002D0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4712	powershell.exe
3584	powershell.exe
3636	powershell.exe
2368	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Nurik.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Nurik.exe

Executes dropped EXE 3 IoCs

pid	Process
5528	Nursultan.exe
4480	Nurik.exe
564	Runtime Broker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Local\\Runtime Broker.exe"	Nurik.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5528	Nursultan.exe
5528	Nursultan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3584	powershell.exe
3584	powershell.exe
3636	powershell.exe
3636	powershell.exe
2368	powershell.exe
2368	powershell.exe
4712	powershell.exe
4712	powershell.exe
4480	Nurik.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	Nurik.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4480	Nurik.exe
Token: SeDebugPrivilege	564	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4480	Nurik.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 5528	5900	Nursultan.exe	78
PID 5900 wrote to memory of 4480	5900	Nursultan.exe	79
PID 4480 wrote to memory of 3584	4480	Nurik.exe	80
PID 4480 wrote to memory of 3636	4480	Nurik.exe	82
PID 4480 wrote to memory of 2368	4480	Nurik.exe	84
PID 4480 wrote to memory of 4712	4480	Nurik.exe	86

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Roaming\Nursultan.exe
  "C:\Users\Admin\AppData\Roaming\Nursultan.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5528
- C:\Users\Admin\AppData\Roaming\Nurik.exe
  "C:\Users\Admin\AppData\Roaming\Nurik.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nurik.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nurik.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4712

C:\Users\Admin\AppData\Local\Runtime Broker.exe
"C:\Users\Admin\AppData\Local\Runtime Broker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ceceebdbd877d161f925e88d1983f280ddd0d9f053aedb0933a4ce9b0e87d56e
MD5 74b36cdea857534f335ca01cf989c95d
SHA1 17e64556a910c99db09300818cf3244a0ffd0fc9
SHA512 a608fb113e4a11c2a5ace3fe9f5e589bfae960b2fba4fa10c9ca0ab7453e3d8cbbd62b0a9a42ee43154ab359aafdb68e3c3445d7f7e7a1531152bab96366bfae
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2a9302d1c91561e0ce57223a62a1e8157d9725bd8143e5ba5436df9e7a45385f
MD5 fd024df0046d90000afe190f737a218f
SHA1 6fc7949edaf6d91529a5c43f849a31893736523d
SHA512 121b483c00a09e5a784dc6221cde838ea783f51bb1213576db3b96c09402251b00d7668bde1cacef980e50280b9d0bf613029ed1ecd583f5fcb6a861c5dce875
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c8db227184caec96da8b629fd802dca9a5a503da5ca605f58d985bb2e73e91f8
MD5 d496be7b112cedbaedd47c600089542e
SHA1 02d4938163a398038390a9848d6026a4c0be4186
SHA512 34e5ef3f60355048f9e70797c61a7203f2bb9a6eaa72ca73686e2be62b876fd0acce509124ad39b9a12a5137013701c9085f4f48aac9bd7fb84e6ff620144a5a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dsflatxd.w01.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsflatxd.w01.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Nurik.exe

Path C:\Users\Admin\AppData\Roaming\Nurik.exe
Size 39KB
SHA256 bb8c81374ac0975a94403e85f21888b561f4b3f04f8174dfbb65aa656d0f57ab
MD5 6eb21a9bb098a808c097e27c992e97dc
SHA1 f0edbdb2b1651c1c5fd7ee86a00d5585490e8e83
SHA512 bf0be936a38f034729e2e0e94d8d306cac10ffd9128f3c47f53500f3645c82eefb32da006c4851467a0f44c7032d5a5b1559aad1fe3c2e2c9fade79cf37dd300
SSDEEP 768:7x/e61/8hsUXQcHlqPmKuufhjrHryT1FWPA9dOfZ16cOMhPaX5:t10hsUgalYmKuu12FL9dg6cOMVc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nursultan.exe

Path C:\Users\Admin\AppData\Roaming\Nursultan.exe
Size 15.9MB
SHA256 b11dcdb51365a6ef1a5292c5e530b5fd56797d3330be5dbe890d68982473c0ba
MD5 88723fc93d21bafee9e5538f16c72a37
SHA1 74363bfb304832c139a8732b06246f49fe50aaa5
SHA512 1c5102e047dd926be666f1422fb04f1f889ad05a47d5d87490bc6cc18848c48816fd5cf7212798af6a95d1c35924744df7e5d75a97ffa82dafa47c80ff88cf23
SSDEEP 393216:k7MOG4esKhrQcRW6ydGldBzr21iLOslPu2do022OaITm:AMOG4evd46ZJOfLDTC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3584-37-0x000001526D3A0000-0x000001526D3AA000-memory.dmp

Download

memory/3584-38-0x000001526D4C0000-0x000001526D4DC000-memory.dmp

Download

memory/3584-39-0x000001526D3B0000-0x000001526D3BA000-memory.dmp

Download

memory/3584-40-0x000001526D4E0000-0x000001526D4FA000-memory.dmp

Download

memory/3584-41-0x000001526D4A0000-0x000001526D4A8000-memory.dmp

Download

memory/3584-42-0x000001526D4B0000-0x000001526D4B6000-memory.dmp

Download

memory/3584-43-0x000001526D500000-0x000001526D50A000-memory.dmp

Download

memory/3584-35-0x000001526D3C0000-0x000001526D3DC000-memory.dmp

Download

memory/3584-36-0x000001526D3E0000-0x000001526D493000-memory.dmp

Download

memory/3584-28-0x0000015254280000-0x00000152542A2000-memory.dmp

Download

memory/4480-20-0x00000000002C0000-0x00000000002D0000-memory.dmp

Download

memory/5900-0-0x00000000001D0000-0x00000000011E2000-memory.dmp

Download