Overview

overview

10

Static

static

3

Boostrappersolara.exe

windows10-ltsc 2021-x64

10

Boostrappersolara.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    107s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/11/2024, 12:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Boostrappersolara.exe
  • Size 1021KB
  • Sample241111-pe75fasncm
  • SHA256 1b0595d3b145f0711f4955ef0cf400fc109240dd2a4507d3c70d43e3c7f5ddf6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormdiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • plant-surfaces.gl.at.ply.gg:7445

Mutex

  • oXkaMvOL23mmqd7M

Attributes
  • Install_directory

    %Temp%

  • install_file

    svchost.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Boostrappersolara.exe
    "C:\Users\Admin\AppData\Local\Temp\Boostrappersolara.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6112
    • C:\Users\Admin\AppData\Local\Temp\Bootstrapper(без ратки).exe
      "C:\Users\Admin\AppData\Local\Temp\Bootstrapper(без ратки).exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6136
      • C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.22.exe
        "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.22.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper(без ратки).exe" --isUpdate true
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:232
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c ipconfig /all
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2404
          • C:\Windows\system32\ipconfig.exe
            ipconfig /all
            5⤵
            • Gathers network information
            PID:772
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5160
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2776
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3364
        • C:\ProgramData\Solara\Solara.exe
          "C:\ProgramData\Solara\Solara.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1880
    • C:\Users\Admin\AppData\Local\Temp\ratka15september.exe
      "C:\Users\Admin\AppData\Local\Temp\ratka15september.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ratka15september.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2976
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ratka15september.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:672
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5752
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4996
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5136
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding DF7DFBA51E18E482857E691045AAA97B
      2⤵
      • Loads dropped DLL
      PID:4536
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D6548836498CE0D432C45490E425C020
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4828
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4901D9C5C87ECA77E5CA40A9307D6AFC E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Windows\SysWOW64\wevtutil.exe
        "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Windows\System32\wevtutil.exe
          "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
          4⤵
            PID:5696

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5809b2.rbs
          • Path C:\Config.Msi\e5809b2.rbs
          • Size 1.0MB
          • SHA256 760bb284e7e82689ff609cf5272f20740466590d09de850554372bc870c988df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          node_etw_provider.man
          • Path C:\Program Files\nodejs\node_etw_provider.man
          • Size 10KB
          • SHA256 1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          node_etw_provider.man
          • Path C:\Program Files\nodejs\node_etw_provider.man
          • Size 8KB
          • SHA256 1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          LICENSE.md
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md
          • Size 818B
          • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
          • MD5 SHA1 SHA512
          Submit Download

          license
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license
          • Size 1KB
          • SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
          • Size 754B
          • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE.md
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md
          • Size 771B
          • SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE
          • Size 730B
          • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
          • MD5 SHA1 SHA512
          Submit Download

          package.json
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
          • Size 1KB
          • SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
          • Size 802B
          • SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
          • MD5 SHA1 SHA512
          Submit Download

          index.js
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
          • Size 16KB
          • SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE
          • Size 780B
          • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
          • Size 763B
          • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
          • MD5 SHA1 SHA512
          Submit Download

          index.d.ts
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
          • Size 4KB
          • SHA256 dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE
          • Size 771B
          • SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
          • MD5 SHA1 SHA512
          Submit Download

          Node.js documentation.url
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
          • Size 168B
          • SHA256 7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9
          • MD5 SHA1 SHA512
          Submit Download

          Node.js website.url
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
          • Size 133B
          • SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
          • MD5 SHA1 SHA512
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\ProgramData\Solara\Newtonsoft.Json.dll
          • Size 695KB
          • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Solara.exe
          • Path C:\ProgramData\Solara\Solara.exe
          • Size 133KB
          • SHA256 d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Wpf.Ui.dll
          • Path C:\ProgramData\Solara\Wpf.Ui.dll
          • Size 5.2MB
          • SHA256 46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 7e510fc9344ef239ab1ab650dc95bb25fd44e2efba8b8246a3ac17880ee8b69e
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 612ad7573cdb7beee36bea28c8d64fe89b3e78ca32c17215d166db2ec604a46c
          • MD5 SHA1 SHA512
          Submit Download

          Bootstrapper(без ратки).exe
          • Path C:\Users\Admin\AppData\Local\Temp\Bootstrapper(без ратки).exe
          • Size 972KB
          • SHA256 97572bd57b08b59744e4dfe6f93fb96be4002dfe1aa78683771725401776464f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BootstrapperV1.22.exe
          • Path C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.22.exe
          • Size 800KB
          • SHA256 ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DISCORD
          • Path C:\Users\Admin\AppData\Local\Temp\DISCORD
          • Size 103B
          • SHA256 b03c8c2d2429e9dbc7920113dedf6fc09095ab39421ee0cc8819ad412e5d67b9
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_nsmncpj1.gdw.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nsmncpj1.gdw.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          node-v18.16.0-x64.msi
          • Path C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
          • Size 30.1MB
          • SHA256 5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ratka15september.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ratka15september.exe
          • Size 39KB
          • SHA256 501789067f7d903fd458a8e6dd3b2442f79aa65792ece563412f13bfcb3eea2b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSI100A.tmp
          • Path C:\Windows\Installer\MSI100A.tmp
          • Size 211KB
          • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSI1462.tmp
          • Path C:\Windows\Installer\MSI1462.tmp
          • Size 297KB
          • SHA256 b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIF6C.tmp
          • Path C:\Windows\Installer\MSIF6C.tmp
          • Size 122KB
          • SHA256 e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/232-91-0x0000025A46B80000-0x0000025A46C4E000-memory.dmp
          Download

          memory/232-2473-0x0000025A61550000-0x0000025A61562000-memory.dmp
          Download

          memory/232-2471-0x0000025A63DD0000-0x0000025A63DDA000-memory.dmp
          Download

          memory/1880-2889-0x00000205E9150000-0x00000205E9174000-memory.dmp
          Download

          memory/1880-2893-0x00000205EB9D0000-0x00000205EBA8A000-memory.dmp
          Download

          memory/1880-2895-0x00000205EBAC0000-0x00000205EBB72000-memory.dmp
          Download

          memory/1880-2892-0x00000205EC000000-0x00000205EC53C000-memory.dmp
          Download

          memory/2976-35-0x000001AEE9FD0000-0x000001AEE9FF2000-memory.dmp
          Download

          memory/3580-27-0x00007FFAABF10000-0x00007FFAAC9D2000-memory.dmp
          Download

          memory/3580-25-0x0000000000D80000-0x0000000000D90000-memory.dmp
          Download

          memory/3580-77-0x00007FFAABF10000-0x00007FFAAC9D2000-memory.dmp
          Download

          memory/6112-1-0x0000000000010000-0x0000000000116000-memory.dmp
          Download

          memory/6112-0-0x00007FFAABF13000-0x00007FFAABF15000-memory.dmp
          Download

          memory/6136-26-0x000002B30E690000-0x000002B30E78A000-memory.dmp
          Download

          memory/6136-90-0x00007FFAABF10000-0x00007FFAAC9D2000-memory.dmp
          Download

          memory/6136-28-0x00007FFAABF10000-0x00007FFAAC9D2000-memory.dmp
          Download