Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
25/01/2026, 09:25
General
- Target Nursultan.exe
- Size 666.2MB
- Sample260125-ldk2qsfx4e
- SHA256 627eb155f3bafa25b0911e49e21532c5de138b95d07f1d28f6e1609263344553
Malware Config
Extracted
-
xworm
-
garellla-30563.portmap.host:30563
-
:123
-
Install_directory
%Userprofile%
-
install_file
SystemMonitor.exe
-
telegram
https://api.telegram.org/bot8572642464:AAEvzmeLVcgU_2c8gHXU7n6IzlJgfhPECEc/sendMessage?chat_id=7667747693
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bnd_62bf3e44\в склейку.exe"C:\Users\Admin\AppData\Local\Temp\bnd_62bf3e44\в склейку.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bnd_62bf3e44\2 склейка.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\fsutil.exefsutil dirty query C:3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bnd_62bf3e44\'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension '.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\bnd_62bf3e44\sdfsd.exe"C:\Users\Admin\AppData\Local\Temp\bnd_62bf3e44\sdfsd.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mwimawjh.0do.ps1
2 склейка.bat
sdfsd.exe
в склейку.exe
memory/2200-14-0x0000000000C70000-0x0000000000C88000-memory.dmp
memory/2200-40-0x000000001CF30000-0x000000001CF40000-memory.dmp
memory/2308-0-0x0000000000BD0000-0x0000000001C12000-memory.dmp
memory/2832-64-0x000001ACCCD30000-0x000001ACCCDE3000-memory.dmp
memory/3520-41-0x00000237EC560000-0x00000237EC56A000-memory.dmp
memory/3520-42-0x00000237EC670000-0x00000237EC68C000-memory.dmp
memory/3520-43-0x00000237EC650000-0x00000237EC65A000-memory.dmp
memory/3520-44-0x00000237EC6B0000-0x00000237EC6CA000-memory.dmp
memory/3520-45-0x00000237EC660000-0x00000237EC668000-memory.dmp
memory/3520-46-0x00000237EC690000-0x00000237EC696000-memory.dmp
memory/3520-47-0x00000237EC6A0000-0x00000237EC6AA000-memory.dmp
memory/3520-39-0x00000237EC590000-0x00000237EC643000-memory.dmp
memory/3520-38-0x00000237EC570000-0x00000237EC58C000-memory.dmp
memory/3520-24-0x00000237EC4C0000-0x00000237EC4E2000-memory.dmp