xworm | a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7

General

Target

a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe
Size

327KB
MD5

e8bcc353f4f717e0a9ec8df42c34beb4
SHA1

56b5eedbe3ecc2c44a887bbd1f2d9dbb4a9ed97c
SHA256

a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7
SHA512

0c6efe15d37163e96551915bef458b91c29ef79712e3d4c4b18272acaa33538af74f6515cd63be622005aded238c761010778e0af8dea4adfdec3ef7c587fd84
SSDEEP

6144:n98Spzgs21x/GJqkntASwQvJzp8kRJoKXqwUHrsTB2zs+FAWKiXG/D8Sf7KVyBs:+Kgs2X/gDiVBQTB2zI6S8SW8Bs

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.0

C2

silver-bowl.gl.at.ply.gg:29206

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012262-6.dat	family_xworm
behavioral1/memory/2892-9-0x0000000000980000-0x0000000000998000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2828	powershell.exe
2688	powershell.exe
1096	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solara.lnk	Solara.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solara.lnk	Solara.exe

Executes dropped EXE 2 IoCs

pid	Process
2892	Solara.exe
2096	Bootstrapper v4.exe

Loads dropped DLL 7 IoCs

pid	Process
2732	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe
2880	Process not Found
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe
2332	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe"	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bootstrapper v4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bootstrapper v4.exe"	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1096	powershell.exe
2828	powershell.exe
2688	powershell.exe
2892	Solara.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	Solara.exe
Token: SeDebugPrivilege	2096	Bootstrapper v4.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2892	Solara.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2892	Solara.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2892	2732	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe	30
PID 2732 wrote to memory of 2892	2732	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe	30
PID 2732 wrote to memory of 2892	2732	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe	30
PID 2732 wrote to memory of 2096	2732	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe	31
PID 2732 wrote to memory of 2096	2732	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe	31
PID 2732 wrote to memory of 2096	2732	a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe	31
PID 2096 wrote to memory of 2332	2096	Bootstrapper v4.exe	34
PID 2096 wrote to memory of 2332	2096	Bootstrapper v4.exe	34
PID 2096 wrote to memory of 2332	2096	Bootstrapper v4.exe	34
PID 2892 wrote to memory of 1096	2892	Solara.exe	35
PID 2892 wrote to memory of 1096	2892	Solara.exe	35
PID 2892 wrote to memory of 1096	2892	Solara.exe	35
PID 2892 wrote to memory of 2828	2892	Solara.exe	37
PID 2892 wrote to memory of 2828	2892	Solara.exe	37
PID 2892 wrote to memory of 2828	2892	Solara.exe	37
PID 2892 wrote to memory of 2688	2892	Solara.exe	39
PID 2892 wrote to memory of 2688	2892	Solara.exe	39
PID 2892 wrote to memory of 2688	2892	Solara.exe	39

C:\Users\Admin\AppData\Local\Temp\a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe
"C:\Users\Admin\AppData\Local\Temp\a272b0c9c1ef29b030408018c792c43d5f8f0b2b43142af5cb52bcfba899e4c7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper v4.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper v4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2096 -s 1076
    3⤵
    - Loads dropped DLL
    PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bootstrapper v4.exe

Filesize
796KB

MD5
4b94b989b0fe7bec6311153b309dfe81

SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22

SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.exe

Filesize
69KB

MD5
5b4fbede12d2186702efdc865fcd2525

SHA1
851d03d19d187440056cc694d5c3598133e080ff

SHA256
d16034eb1f8fa2ead62e9128109de6188156c6926665188958fa7fe2c3e0a63e

SHA512
791ee49dd5848908cb658982557702c8164f538e325fec272ca5388bdd7f09b808c5b3f743ea198fc989a4373c7e435e9108121a1aee210b6fc898034d9c1516

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
42e78f8aae70a5d37ff963ffe46b68f0

SHA1
5c6b3e1eff9cea2fcb4012ef887f8e04299a1e2f

SHA256
979c27ea6b530414a1471b8bd05b3ebce18626337e22d1d8d154d967243dd86a

SHA512
a922e46848c6d227f978b3d1a0d2098316ab3c4745a729008094d54829f72f40c15d74b35b604e34a8d2a4687bd6bcf8541360b0acb89a9c37118bcae4cc8697

Download Submit
memory/1096-29-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/1096-28-0x000000001B350000-0x000000001B632000-memory.dmp

Filesize
2.9MB

Download
memory/2096-17-0x00000000013B0000-0x000000000147E000-memory.dmp

Filesize
824KB

Download
memory/2732-18-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download
memory/2732-0-0x000007FEF54E3000-0x000007FEF54E4000-memory.dmp

Filesize
4KB

Download
memory/2732-13-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download
memory/2732-1-0x000000013F650000-0x000000013F6A6000-memory.dmp

Filesize
344KB

Download
memory/2828-35-0x000000001B150000-0x000000001B432000-memory.dmp

Filesize
2.9MB

Download
memory/2828-36-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2892-15-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download
memory/2892-9-0x0000000000980000-0x0000000000998000-memory.dmp

Filesize
96KB

Download
memory/2892-42-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download
memory/2892-48-0x00000000022D0000-0x00000000022DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads