Overview

overview

10

Static

static

3

Nursultan.exe

windows10-2004-x64

10

Nursultan.exe

windows10-ltsc_2021-x64

10

Nursultan.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Nursultan.exe (2) (infected).7z
  • Size 663.6MB
  • Sample260125-ldk2qsfx4e
  • SHA256 3c49b8cec43afebcdf953c5168cdcc3eb7d5ac6afeb69bf4ff2bcf6e730d27be
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • garellla-30563.portmap.host:30563

  • :123

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    SystemMonitor.exe

  • telegram

    https://api.telegram.org/bot8572642464:AAEvzmeLVcgU_2c8gHXU7n6IzlJgfhPECEc/sendMessage?chat_id=7667747693

Targets

    • Target
      Nursultan.exe
    • Size 666.2MB
    • SHA256 627eb155f3bafa25b0911e49e21532c5de138b95d07f1d28f6e1609263344553
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executionxwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks