| File name: | Nursultan Alpha Client.rar |
| Full analysis: | https://app.any.run/tasks/f154cdb9-2bb7-4434-9d34-d00415afd205 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | January 11, 2025, 04:53:16 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 25E292B4AEA3A4BA5FAF5E76753A3666 |
| SHA1: | 4B48AD72CFB44A850A3C0DF18C03A006B66E4481 |
| SHA256: | 410AB05D1E52A0B538F5D60AFF239528481A2DF168A497AFE865E2100EBA3F6B |
| SSDEEP: | 196608:ojqamqpQDYXQOzyGnGTtbXycAV7risv0dB9wu9:ojSqbQmfGTdCp9is8dB9wu9 |
MALICIOUS
XWORM has been detected (YARA)
- Nursultan Client Alpha.exe (PID: 6488)
Changes the autorun value in the registry
- Nursultan Client Alpha.exe (PID: 6488)
Create files in the Startup directory
- Nursultan Client Alpha.exe (PID: 6488)
XWORM has been detected (SURICATA)
- Nursultan Client Alpha.exe (PID: 6488)
SUSPICIOUS
Checks for external IP
- svchost.exe (PID: 2192)
- Nursultan Client Alpha.exe (PID: 6488)
Possible usage of Discord/Telegram API has been detected (YARA)
- Nursultan Client Alpha.exe (PID: 6488)
Connects to unusual port
- Nursultan Client Alpha.exe (PID: 6488)
Executable content was dropped or overwritten
- Nursultan Client Alpha.exe (PID: 6488)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- Nursultan Client Alpha.exe (PID: 6488)
Contacting a server suspected of hosting an CnC
- Nursultan Client Alpha.exe (PID: 6488)
INFO
Checks supported languages
- Nursultan Client Alpha.exe (PID: 6488)
Manual execution by a user
- Nursultan Client Alpha.exe (PID: 6488)
- OpenWith.exe (PID: 6564)
- notepad.exe (PID: 6524)
The sample compiled with english language support
- WinRAR.exe (PID: 6328)
Reads Microsoft Office registry keys
- OpenWith.exe (PID: 6564)
Reads the computer name
- Nursultan Client Alpha.exe (PID: 6488)
Reads the machine GUID from the registry
- Nursultan Client Alpha.exe (PID: 6488)
Reads Environment values
- Nursultan Client Alpha.exe (PID: 6488)
Checks proxy server information
- Nursultan Client Alpha.exe (PID: 6488)
Reads security settings of Internet Explorer
- notepad.exe (PID: 6524)
Disables trace logs
- Nursultan Client Alpha.exe (PID: 6488)
Creates files or folders in the user directory
- Nursultan Client Alpha.exe (PID: 6488)
Reads the software policy settings
- Nursultan Client Alpha.exe (PID: 6488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| FileVersion: | RAR v5 |
|---|---|
| CompressedSize: | 171 |
| UncompressedSize: | 179 |
| OperatingSystem: | Win32 |
| ArchivedFileName: | ПРОЧИТАЙ, если не запускает.txt |
Total processes
129
Monitored processes
5
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6328 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Nursultan Alpha Client.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6488 | "C:\Users\admin\Desktop\Nursultan Client Alpha.exe" | C:\Users\admin\Desktop\Nursultan Client Alpha.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 1.0.0.0 Modules
| |||||||||||||||
| 6524 | "C:\WINDOWS\system32\NOTEPAD.EXE" "C:\Users\admin\Desktop\ПРОЧИТАЙ, если не запускает.txt" | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6564 | "C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\nuru.spec | C:\Windows\System32\OpenWith.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Pick an app Exit code: 2147943623 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
4 049
Read events
4 025
Write events
24
Delete events
0
Modification events
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Nursultan Alpha Client.rar | |||
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6488) Nursultan Client Alpha.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Nursultan Client Alpha_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (6488) Nursultan Client Alpha.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Nursultan Client Alpha_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6488 | Nursultan Client Alpha.exe | C:\Users\admin\dllhost | executable | |
MD5:BD03AE5EEEFD2BDD370F86F7E17742B3 | SHA256:17116675A67A756FA14836EFD1E310ACC10687B6B8330C3D676F65D1D0782C6D | |||
| 6488 | Nursultan Client Alpha.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.lnk | binary | |
MD5:7B19D6E7DCDB3E6391CFC0EDC9141660 | SHA256:440383C2597A0D7A86ED9CF9B35CB10649BF74E19294F0F6B869C6A1BFFF80DC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
37
DNS requests
21
Threats
10
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6488 | Nursultan Client Alpha.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.72:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6956 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6956 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5732 | RUXIMICS.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1176 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
— | — | 184.28.89.167:443 | go.microsoft.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
ip-api.com |
| shared |
api.telegram.org |
| shared |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
2192 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
6488 | Nursultan Client Alpha.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
6488 | Nursultan Client Alpha.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
2192 | svchost.exe | Misc activity | SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram |
6488 | Nursultan Client Alpha.exe | Misc activity | ET HUNTING Telegram API Certificate Observed |
6488 | Nursultan Client Alpha.exe | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |
2192 | svchost.exe | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |
6488 | Nursultan Client Alpha.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm TCP Packet |
6488 | Nursultan Client Alpha.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm TCP Packet |