xworm | eed43c12866f5d2d70382ccd10a07670e4b935885a3dbf375da38b8924339b0d

General

Target

Solara v2.exe
Size

230KB
MD5

2c97e31fdc209f1ae51f1dc93a7993a7
SHA1

fc6214f6e91809aaf29fa39cc6a0ebd09fa35909
SHA256

eed43c12866f5d2d70382ccd10a07670e4b935885a3dbf375da38b8924339b0d
SHA512

17d0b2244ceeb9d0d7cc75529a071bf4208b8b8b7d77d69f4639e5f2c2c8e66f81fc5a49689741caae9967a23877e0841f4aeb139471bd46f5ba95cdb9b6a415
SSDEEP

3072:H/FnmqDWX+bSdKsmCOEtrH8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9Nz8:nDWub5kUhcX7elbKTua9bfF/H9d9n

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

takes-stewart.gl.at.ply.gg:61176

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/208-0-0x0000000000310000-0x000000000034E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2328 powershell.exe
1124 powershell.exe
3204 powershell.exe
2084 powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Solara v2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Solara v2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Solara v2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	Solara v2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeSolara v2.exe

pid	process
2328	powershell.exe
2328	powershell.exe
1124	powershell.exe
1124	powershell.exe
3204	powershell.exe
3204	powershell.exe
2084	powershell.exe
2084	powershell.exe
208	Solara v2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Solara v2.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	208	Solara v2.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	208	Solara v2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Solara v2.exe

pid process

208 Solara v2.exe

pid	process
208	Solara v2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Solara v2.exe

description	pid	process	target process
PID 208 wrote to memory of 2328	208	Solara v2.exe	powershell.exe
PID 208 wrote to memory of 2328	208	Solara v2.exe	powershell.exe
PID 208 wrote to memory of 1124	208	Solara v2.exe	powershell.exe
PID 208 wrote to memory of 1124	208	Solara v2.exe	powershell.exe
PID 208 wrote to memory of 3204	208	Solara v2.exe	powershell.exe
PID 208 wrote to memory of 3204	208	Solara v2.exe	powershell.exe
PID 208 wrote to memory of 2084	208	Solara v2.exe	powershell.exe
PID 208 wrote to memory of 2084	208	Solara v2.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Solara v2.exe
"C:\Users\Admin\AppData\Local\Temp\Solara v2.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara v2.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara v2.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ea40386e93203f2f2712bd0bf029cfa4

SHA1
e3e27a3dbda20298f4f93fa14b6a07cee649bd61

SHA256
c031090ef773b0453a97ab7aaa94dfe4f2bb4a35cc369c41933c20bdd666c72c

SHA512
e7590d696a53c97b955092637a14c3b691ecf2dd15701d9ef05ba2973d0cbbbc7439f0e180c0244960be2db7160f97519783f6fa71b2503aa963b25dd39fa121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
b7189719e6df2c3dfc76197ec3f31f7a

SHA1
effd91412deadc87cc10ef76cdecc1e0b54b6d41

SHA256
1c72fa37d078b92c7e900b2e3d17c43c34d936a696a8ddf6c519f4a80308b892

SHA512
2df1f1d45844da7ffb17cdfb411f223e9c614c00f5cf7eb5ba92bf7ba174875af2a515371208286c95c0479c934ae2c6a83dfc0b54380be89db1eddd19faf978

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_afcfe0go.mye.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/208-1-0x00007FFEC4133000-0x00007FFEC4135000-memory.dmp

Filesize
8KB

Download
memory/208-0-0x0000000000310000-0x000000000034E000-memory.dmp

Filesize
248KB

Download
memory/208-52-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/208-53-0x00007FFEC4133000-0x00007FFEC4135000-memory.dmp

Filesize
8KB

Download
memory/208-54-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/208-56-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-13-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-16-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-12-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-2-0x00000199E2670000-0x00000199E2692000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads