Analysis
- user interaction
yes - max time kernel
59s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 18:07
General
- Target Nylon-X.exe
- Size 6.3MB
- Sample260919-wp9vcaab43
- SHA256 b53bea26b1676567fadc50ce6dc347de8a94f552e2233525c7427ce52666b9d2
Malware Config
Signatures
- Contains code to disable Windows Defender 5 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nylon-X.exe"C:\Users\Admin\AppData\Local\Temp\Nylon-X.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Checks for any installed AV software in registry
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c curl.exe -s --connect-timeout 3 --max-time 6 -D "C:\Users\Admin\AppData\Local\Temp\NylonX_time.hdr" -o NUL http://www.google.com2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl.exe -s --connect-timeout 3 --max-time 6 -D "C:\Users\Admin\AppData\Local\Temp\NylonX_time.hdr" -o NUL http://www.google.com3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring True; Set-MpPreference -DisableBehaviorMonitoring True; Set-MpPreference -DisableIOAVProtection True"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring True; Set-MpPreference -DisableBehaviorMonitoring True; Set-MpPreference -DisableIOAVProtection True"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
NylonX_time.hdr
memory/3504-35-0x00007FF6B5CE0000-0x00007FF6B63C5000-memory.dmp
memory/3504-34-0x00007FF6B5CE0000-0x00007FF6B63C5000-memory.dmp
memory/3504-33-0x00007FF6B5CE0000-0x00007FF6B63C5000-memory.dmp
memory/3504-31-0x00007FF6B5CE0000-0x00007FF6B63C5000-memory.dmp
memory/3504-30-0x00007FF6B5CE0000-0x00007FF6B63C5000-memory.dmp
memory/4576-19-0x00000184C9A20000-0x00000184C9A2A000-memory.dmp
memory/4576-25-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-13-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-14-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-17-0x00000184C9A30000-0x00000184C9A4E000-memory.dmp
memory/4576-18-0x00000184C9C60000-0x00000184C9D12000-memory.dmp
memory/4576-11-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-20-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-21-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-23-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-24-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-12-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-22-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-27-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-29-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-10-0x00000184C9990000-0x00000184C99B2000-memory.dmp
memory/4576-7-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-32-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-6-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-5-0x00007FF943FE0000-0x00007FF944984000-memory.dmp
memory/4576-4-0x00007FF94416F000-0x00007FF944170000-memory.dmp