Analysis
- geolocation tags
eueuropelondonukunited-kingdom - user interaction
yes - max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-uk - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows - submitted
26/06/2026, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nursultan.exe
Resource
win11ltsc2024-20260618-uk
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target Nursultan.exe
- Size 625KB
- Sample260626-17e5xae18t
- SHA256 268f999e217077dafeb9ca862cbfc9aa94d2bd86888b6ea8fbc8d482b74f0936
- MD5 4b4f2dd7e161d711bb515ba020b8772e
- SHA1 4e2c37577a8536c8e8b45015a9dfbbd7535a3dfa
- SHA512 6b22761ec1faaa83c4467b97ffb7708a4c0235ee135e64cc9ac56eef141836e7204f1323ad43c1ac32b2b76b8240d7addd824b1ee1ae3ebee9bd67c3391f0e97
- SSDEEP 6144:v1+KqIt3l9X8Kwy5KsBB+Ut1cGbYK3Jxvvj4wjuR8oc0jIVxeIIgwZLrNHyL8UoM:Nbp8iBQu18K3swe3Zy8j72UjvRLTy4v
- TLSH T1C4D4D4143B95CAC8D48017FE455A1A09DB9B99F125F2E303370AFA61CD458DEDE2C3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDefender.exe" Nursultan.exe - Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Executes dropped EXE 6 IoCs
pid Process 6052 xdwdDefender.exe 6460 xdwdDefender.exe 5148 xdwdMalwareDef.exe 6948 xdwdDefender.exe 3168 xdwdDefender.exe 3260 xdwdDefender.exe - Loads dropped DLL 18 IoCs
pid Process 6460 xdwdDefender.exe 4868 Process not Found 5148 xdwdMalwareDef.exe 6948 xdwdDefender.exe 3656 Process not Found 252 taskmgr.exe 6796 Process not Found 3196 rundll32.exe 3168 xdwdDefender.exe 2844 Process not Found 984 Process not Found 3992 Process not Found 4416 svchost.exe 5204 Process not Found 4288 SecurityHealthHost.exe 3956 svchost.exe 5808 svchost.exe 3260 xdwdDefender.exe - Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 api.ipify.org 9 api.ipify.org 23 api.ipify.org 56 api.ipify.org 1 api.ipify.org 1 icanhazip.com 5 icanhazip.com 6 api.ipify.org - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdDefender.exe File opened for modification C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl svchost.exe File opened for modification C:\Windows\System32\xdwdDefender.exe Nursultan.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdDefender.exe File opened for modification C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT svchost.exe File created C:\Windows\System32\xdwdDefender.exe Nursultan.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdDefender.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdMalwareDef.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdDefender.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Web\xdwdMalwareDef.exe Nursultan.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe Nursultan.exe File created C:\Windows\xdwd.dll Nursultan.exe File opened for modification C:\Windows\xdwd.dll Nursultan.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdDefender.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdDefender.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdMalwareDef.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdDefender.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdDefender.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2096 schtasks.exe 5788 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 252 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 5664 Nursultan.exe Token: SeDebugPrivilege 6052 xdwdDefender.exe Token: SeDebugPrivilege 6460 xdwdDefender.exe Token: SeDebugPrivilege 5148 xdwdMalwareDef.exe Token: SeIncBasePriorityPrivilege 6052 xdwdDefender.exe Token: SeDebugPrivilege 6948 xdwdDefender.exe Token: SeDebugPrivilege 252 taskmgr.exe Token: SeSystemProfilePrivilege 252 taskmgr.exe Token: SeCreateGlobalPrivilege 252 taskmgr.exe Token: SeDebugPrivilege 3168 xdwdDefender.exe Token: SeShutdownPrivilege 4028 svchost.exe Token: SeDebugPrivilege 3260 xdwdDefender.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe 252 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 252 taskmgr.exe 2640 SecHealthUI.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5664 wrote to memory of 3228 5664 Nursultan.exe 92 PID 5664 wrote to memory of 1228 5664 Nursultan.exe 93 PID 1228 wrote to memory of 5788 1228 cmd.exe 96 PID 5664 wrote to memory of 4976 5664 Nursultan.exe 98 PID 4976 wrote to memory of 2096 4976 cmd.exe 100 PID 5664 wrote to memory of 6460 5664 Nursultan.exe 102 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="6 EAqKO!qE5#qJ" dir=in action=allow program="C:\Windows\System32\xdwdDefender.exe" enable=yes & exit2⤵PID:3228
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5788
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2096
-
-
-
C:\Windows\System32\xdwdDefender.exe"C:\Windows\System32\xdwdDefender.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6460
-
-
C:\Windows\System32\xdwdDefender.exeC:\Windows\System32\xdwdDefender.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6052
-
C:\Windows\Web\xdwdMalwareDef.exeC:\Windows\Web\xdwdMalwareDef.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5148
-
C:\Windows\System32\xdwdDefender.exe"C:\Windows\System32\xdwdDefender.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6948
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:252
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
- Loads dropped DLL
PID:3196
-
C:\Windows\System32\xdwdDefender.exe"C:\Windows\System32\xdwdDefender.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
- Loads dropped DLL
PID:4416
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
- Loads dropped DLL
PID:4288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
- Loads dropped DLL
PID:3956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:5808
-
C:\Windows\System32\xdwdDefender.exe"C:\Windows\System32\xdwdDefender.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3260
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\xdwdDefender.exe
- Size 625KB
- SHA256 268f999e217077dafeb9ca862cbfc9aa94d2bd86888b6ea8fbc8d482b74f0936
- MD5 4b4f2dd7e161d711bb515ba020b8772e
- SHA1 4e2c37577a8536c8e8b45015a9dfbbd7535a3dfa
- SHA512 6b22761ec1faaa83c4467b97ffb7708a4c0235ee135e64cc9ac56eef141836e7204f1323ad43c1ac32b2b76b8240d7addd824b1ee1ae3ebee9bd67c3391f0e97
- SSDEEP 6144:v1+KqIt3l9X8Kwy5KsBB+Ut1cGbYK3Jxvvj4wjuR8oc0jIVxeIIgwZLrNHyL8UoM:Nbp8iBQu18K3swe3Zy8j72UjvRLTy4v
- TLSH T1C4D4D4143B95CAC8D48017FE455A1A09DB9B99F125F2E303370AFA61CD458DEDE2C3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\xdwd.dll
- Size 136KB
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- TLSH T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH