xworm | a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7

General

Target

Solara v4.exe
Size

327KB
MD5

e8bcc353f4f717e0a9ec8df42c34beb4
SHA1

56b5eedbe3ecc2c44a887bbd1f2d9dbb4a9ed97c
SHA256

a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7
SHA512

0c6efe15d37163e96551915bef458b91c29ef79712e3d4c4b18272acaa33538af74f6515cd63be622005aded238c761010778e0af8dea4adfdec3ef7c587fd84
SSDEEP

6144:n98Spzgs21x/GJqkntASwQvJzp8kRJoKXqwUHrsTB2zs+FAWKiXG/D8Sf7KVyBs:+Kgs2X/gDiVBQTB2zI6S8SW8Bs

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.0

C2

silver-bowl.gl.at.ply.gg:29206

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012117-5.dat	family_xworm
behavioral1/memory/1984-9-0x0000000000180000-0x0000000000198000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2344	powershell.exe
2524	powershell.exe
2560	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solara.lnk	Solara.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solara.lnk	Solara.exe

Executes dropped EXE 2 IoCs

pid	Process
1984	Solara.exe
2288	Bootstrapper v4.exe

Loads dropped DLL 7 IoCs

pid	Process
2468	Solara v4.exe
1660	Process not Found
2072	WerFault.exe
2072	WerFault.exe
2072	WerFault.exe
2072	WerFault.exe
2072	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe"	Solara v4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bootstrapper v4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bootstrapper v4.exe"	Solara v4.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2344	powershell.exe
2524	powershell.exe
2560	powershell.exe
1984	Solara.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	Solara.exe
Token: SeDebugPrivilege	2288	Bootstrapper v4.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1984	Solara.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	Solara.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1984	2468	Solara v4.exe	28
PID 2468 wrote to memory of 1984	2468	Solara v4.exe	28
PID 2468 wrote to memory of 1984	2468	Solara v4.exe	28
PID 2468 wrote to memory of 2288	2468	Solara v4.exe	29
PID 2468 wrote to memory of 2288	2468	Solara v4.exe	29
PID 2468 wrote to memory of 2288	2468	Solara v4.exe	29
PID 2288 wrote to memory of 2072	2288	Bootstrapper v4.exe	32
PID 2288 wrote to memory of 2072	2288	Bootstrapper v4.exe	32
PID 2288 wrote to memory of 2072	2288	Bootstrapper v4.exe	32
PID 1984 wrote to memory of 2344	1984	Solara.exe	33
PID 1984 wrote to memory of 2344	1984	Solara.exe	33
PID 1984 wrote to memory of 2344	1984	Solara.exe	33
PID 1984 wrote to memory of 2524	1984	Solara.exe	35
PID 1984 wrote to memory of 2524	1984	Solara.exe	35
PID 1984 wrote to memory of 2524	1984	Solara.exe	35
PID 1984 wrote to memory of 2560	1984	Solara.exe	37
PID 1984 wrote to memory of 2560	1984	Solara.exe	37
PID 1984 wrote to memory of 2560	1984	Solara.exe	37

C:\Users\Admin\AppData\Local\Temp\Solara v4.exe
"C:\Users\Admin\AppData\Local\Temp\Solara v4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper v4.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper v4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2288 -s 1068
    3⤵
    - Loads dropped DLL
    PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bootstrapper v4.exe

Filesize
796KB

MD5
4b94b989b0fe7bec6311153b309dfe81

SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22

SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.exe

Filesize
69KB

MD5
5b4fbede12d2186702efdc865fcd2525

SHA1
851d03d19d187440056cc694d5c3598133e080ff

SHA256
d16034eb1f8fa2ead62e9128109de6188156c6926665188958fa7fe2c3e0a63e

SHA512
791ee49dd5848908cb658982557702c8164f538e325fec272ca5388bdd7f09b808c5b3f743ea198fc989a4373c7e435e9108121a1aee210b6fc898034d9c1516

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
23a4fa30703e1b8fab28079d8d1f9f4e

SHA1
bf1dd7db8fbb670f6df11729160908c853c3ed06

SHA256
f5f49bed27bcfe925077e55874b67ebfb62892f3926c261c4cc833f04fda5a09

SHA512
aca1fab4bb40bd21f53f6eaefee5819cdb623695b68a1b42b7ac097e2d6f169e7338e664129d9d1a7683b5c8c96204610bb27b4bb10b40a0a7d3f928881ceab3

Download Submit
memory/1984-19-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/1984-48-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/1984-15-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/1984-49-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/1984-9-0x0000000000180000-0x0000000000198000-memory.dmp

Filesize
96KB

Download
memory/2288-17-0x0000000000940000-0x0000000000A0E000-memory.dmp

Filesize
824KB

Download
memory/2344-29-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2344-30-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2468-18-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2468-1-0x000000013F7C0000-0x000000013F816000-memory.dmp

Filesize
344KB

Download
memory/2468-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2468-13-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2524-36-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2524-37-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads