Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 17:44
Behavioral task
behavioral1
Sample
Solara v2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Solara v2.exe
Resource
win10v2004-20240508-en
General
-
Target
Solara v2.exe
-
Size
230KB
-
MD5
2c97e31fdc209f1ae51f1dc93a7993a7
-
SHA1
fc6214f6e91809aaf29fa39cc6a0ebd09fa35909
-
SHA256
eed43c12866f5d2d70382ccd10a07670e4b935885a3dbf375da38b8924339b0d
-
SHA512
17d0b2244ceeb9d0d7cc75529a071bf4208b8b8b7d77d69f4639e5f2c2c8e66f81fc5a49689741caae9967a23877e0841f4aeb139471bd46f5ba95cdb9b6a415
-
SSDEEP
3072:H/FnmqDWX+bSdKsmCOEtrH8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9Nz8:nDWub5kUhcX7elbKTua9bfF/H9d9n
Malware Config
Extracted
xworm
takes-stewart.gl.at.ply.gg:61176
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-1-0x00000000000B0000-0x00000000000EE000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2844 powershell.exe 2532 powershell.exe 2556 powershell.exe 2592 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Solara v2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" Solara v2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeSolara v2.exepid process 2844 powershell.exe 2532 powershell.exe 2556 powershell.exe 2592 powershell.exe 1772 Solara v2.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Solara v2.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1772 Solara v2.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2532 powershell.exe Token: SeDebugPrivilege 2556 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeDebugPrivilege 1772 Solara v2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Solara v2.exepid process 1772 Solara v2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Solara v2.exedescription pid process target process PID 1772 wrote to memory of 2844 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2844 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2844 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2532 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2532 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2532 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2556 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2556 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2556 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2592 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2592 1772 Solara v2.exe powershell.exe PID 1772 wrote to memory of 2592 1772 Solara v2.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara v2.exe"C:\Users\Admin\AppData\Local\Temp\Solara v2.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara v2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara v2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5b57d3ee6bdbbae0145669ae54b6b4c2d
SHA1bd434dfc3d96ca1aa3d11e61a5f8c754d4eae806
SHA2567b3ee577a82ca9938cc1eb140c9acd30614019b6ca9007dbd1c31fb8289bd7cd
SHA51255b5c207d7f768be04c402dcd6482314672ab7bfc8cf9ccf5c440f98f9b54ee1bd53c8c16c759af2cf3fca6445f3372a3c81b77655663ccc4a5b61f696173e75
-
memory/1772-1-0x00000000000B0000-0x00000000000EE000-memory.dmpFilesize
248KB
-
memory/1772-0-0x000007FEF50C3000-0x000007FEF50C4000-memory.dmpFilesize
4KB
-
memory/1772-27-0x000000001B1B0000-0x000000001B230000-memory.dmpFilesize
512KB
-
memory/1772-28-0x000007FEF50C3000-0x000007FEF50C4000-memory.dmpFilesize
4KB
-
memory/1772-29-0x000000001B1B0000-0x000000001B230000-memory.dmpFilesize
512KB
-
memory/2532-14-0x000000001B300000-0x000000001B5E2000-memory.dmpFilesize
2.9MB
-
memory/2532-15-0x0000000002470000-0x0000000002478000-memory.dmpFilesize
32KB
-
memory/2844-6-0x0000000002B30000-0x0000000002BB0000-memory.dmpFilesize
512KB
-
memory/2844-7-0x000000001B3C0000-0x000000001B6A2000-memory.dmpFilesize
2.9MB
-
memory/2844-8-0x0000000001E70000-0x0000000001E78000-memory.dmpFilesize
32KB