General

  • Target

    SоlаraV3.exe

  • Size

    326KB

  • Sample

    241111-zs6hwawfjl

  • MD5

    940f68edc497b2364f7751a06e5005c3

  • SHA1

    243867ca7db62c2523dc208056747803308367fd

  • SHA256

    7836ed81b575e364b75dfaea40971da1de436cbd33364d149df3dbc7ce7b5e42

  • SHA512

    c9ad27a4407afdfa3130ccdea30b739bfdfae14e04010b65cf0850b49045d1614eb1b9a47be111d1c1d67ff0f94020208369d28d1ed7e6f038a574a183103f40

  • SSDEEP

    6144:SWUovnLzJmE8O2hWbocJIJytNrlrqowMCjNthw66kIOpWWv7MO/:SWUovH4E8fkLIJkqNIjqW6t

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:3566

college-quarter.gl.at.ply.gg:3566

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    Bootstraper.exe

Targets

    • Target

      SоlаraV3.exe

    • Size

      326KB

    • MD5

      940f68edc497b2364f7751a06e5005c3

    • SHA1

      243867ca7db62c2523dc208056747803308367fd

    • SHA256

      7836ed81b575e364b75dfaea40971da1de436cbd33364d149df3dbc7ce7b5e42

    • SHA512

      c9ad27a4407afdfa3130ccdea30b739bfdfae14e04010b65cf0850b49045d1614eb1b9a47be111d1c1d67ff0f94020208369d28d1ed7e6f038a574a183103f40

    • SSDEEP

      6144:SWUovnLzJmE8O2hWbocJIJytNrlrqowMCjNthw66kIOpWWv7MO/:SWUovH4E8fkLIJkqNIjqW6t

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks