xworm | e2360b23a592c13f932142f87605559201de852fdbd1ba9ca218e4d7a04e45b8

Analysis

max time kernel
21s
max time network
24s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
12-11-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraBootstrapper.exe
Size

279KB
MD5

580dd32c33bf5ec13692dc160b2a3a98
SHA1

8ba0d7dc695d75801a6169ab9b41130a3b305595
SHA256

e2360b23a592c13f932142f87605559201de852fdbd1ba9ca218e4d7a04e45b8
SHA512

7bfbe253971aeab2271fdda1e04f6cdd91e0166da51502ff509f794b4e97cfd0637d8ce2cc64e3b28cdde610032c69bb5f07d244f1cb848f178fd0dd3aacdf3b
SSDEEP

3072:zn+bNARnVa9+be16ZDOYUxiLvAzII9x66AOag74srxxVfPWKvQIFY623:NRzbDyzqONxTGqQI+62

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

22.ip.gl.ply.gg:5299

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4260-1-0x00000000005E0000-0x000000000062C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1172	powershell.exe
4892	powershell.exe
4168	powershell.exe
4748	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	SolaraBootstrapper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	SolaraBootstrapper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	SolaraBootstrapper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4168	powershell.exe
4168	powershell.exe
4748	powershell.exe
4748	powershell.exe
1172	powershell.exe
1172	powershell.exe
4892	powershell.exe
4892	powershell.exe
4260	SolaraBootstrapper.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4260	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeIncreaseQuotaPrivilege	4168	powershell.exe
Token: SeSecurityPrivilege	4168	powershell.exe
Token: SeTakeOwnershipPrivilege	4168	powershell.exe
Token: SeLoadDriverPrivilege	4168	powershell.exe
Token: SeSystemProfilePrivilege	4168	powershell.exe
Token: SeSystemtimePrivilege	4168	powershell.exe
Token: SeProfSingleProcessPrivilege	4168	powershell.exe
Token: SeIncBasePriorityPrivilege	4168	powershell.exe
Token: SeCreatePagefilePrivilege	4168	powershell.exe
Token: SeBackupPrivilege	4168	powershell.exe
Token: SeRestorePrivilege	4168	powershell.exe
Token: SeShutdownPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeSystemEnvironmentPrivilege	4168	powershell.exe
Token: SeRemoteShutdownPrivilege	4168	powershell.exe
Token: SeUndockPrivilege	4168	powershell.exe
Token: SeManageVolumePrivilege	4168	powershell.exe
Token: 33	4168	powershell.exe
Token: 34	4168	powershell.exe
Token: 35	4168	powershell.exe
Token: 36	4168	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeIncreaseQuotaPrivilege	4748	powershell.exe
Token: SeSecurityPrivilege	4748	powershell.exe
Token: SeTakeOwnershipPrivilege	4748	powershell.exe
Token: SeLoadDriverPrivilege	4748	powershell.exe
Token: SeSystemProfilePrivilege	4748	powershell.exe
Token: SeSystemtimePrivilege	4748	powershell.exe
Token: SeProfSingleProcessPrivilege	4748	powershell.exe
Token: SeIncBasePriorityPrivilege	4748	powershell.exe
Token: SeCreatePagefilePrivilege	4748	powershell.exe
Token: SeBackupPrivilege	4748	powershell.exe
Token: SeRestorePrivilege	4748	powershell.exe
Token: SeShutdownPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeSystemEnvironmentPrivilege	4748	powershell.exe
Token: SeRemoteShutdownPrivilege	4748	powershell.exe
Token: SeUndockPrivilege	4748	powershell.exe
Token: SeManageVolumePrivilege	4748	powershell.exe
Token: 33	4748	powershell.exe
Token: 34	4748	powershell.exe
Token: 35	4748	powershell.exe
Token: 36	4748	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeIncreaseQuotaPrivilege	1172	powershell.exe
Token: SeSecurityPrivilege	1172	powershell.exe
Token: SeTakeOwnershipPrivilege	1172	powershell.exe
Token: SeLoadDriverPrivilege	1172	powershell.exe
Token: SeSystemProfilePrivilege	1172	powershell.exe
Token: SeSystemtimePrivilege	1172	powershell.exe
Token: SeProfSingleProcessPrivilege	1172	powershell.exe
Token: SeIncBasePriorityPrivilege	1172	powershell.exe
Token: SeCreatePagefilePrivilege	1172	powershell.exe
Token: SeBackupPrivilege	1172	powershell.exe
Token: SeRestorePrivilege	1172	powershell.exe
Token: SeShutdownPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeSystemEnvironmentPrivilege	1172	powershell.exe
Token: SeRemoteShutdownPrivilege	1172	powershell.exe
Token: SeUndockPrivilege	1172	powershell.exe
Token: SeManageVolumePrivilege	1172	powershell.exe
Token: 33	1172	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4260	SolaraBootstrapper.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4168	4260	SolaraBootstrapper.exe	86
PID 4260 wrote to memory of 4168	4260	SolaraBootstrapper.exe	86
PID 4260 wrote to memory of 4748	4260	SolaraBootstrapper.exe	91
PID 4260 wrote to memory of 4748	4260	SolaraBootstrapper.exe	91
PID 4260 wrote to memory of 1172	4260	SolaraBootstrapper.exe	94
PID 4260 wrote to memory of 1172	4260	SolaraBootstrapper.exe	94
PID 4260 wrote to memory of 4892	4260	SolaraBootstrapper.exe	96
PID 4260 wrote to memory of 4892	4260	SolaraBootstrapper.exe	96

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraBootstrapper.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
60b3262c3163ee3d466199160b9ed07d

SHA1
994ece4ea4e61de0be2fdd580f87e3415f9e1ff6

SHA256
e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb

SHA512
081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
02b2aef23d34a3dd0f1f05e0d7c760a4

SHA1
636a8ae55b4c2658c31b95f5d310853b8b23a5ba

SHA256
7f9c2dc4d0cea089697224af0fb411dcbf8e94ea63de072cd766729ecb346305

SHA512
7b259e1dac35f17bb30d7fcab8c6efa1bb4ee94867500ff5d425bc90f1b8ce5f3c8bb475cc2d7ba6b5ee2d799251753da1e2837e73aa2cf3aba382e6fe301f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
34a048275e971e9356b1ace4d6e861af

SHA1
7b78ad270a07d55b6801727958244ae4c5f65d8b

SHA256
5852881c67d7b92d0a79eba756d4ea1e883ca0753af9207a44978fc45cbe9b43

SHA512
e918134552d8c5202c6aa58099b26900e604d7f661d7fab8fb26ae39cd98fedc4a44f99e1f0ad8c15a143b3991ab582cf8f13732bcd61be2c0ede443b56ad17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wy3uopmz.thb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4168-12-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download
memory/4168-14-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download
memory/4168-15-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download
memory/4168-16-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download
memory/4168-19-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download
memory/4168-13-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download
memory/4168-7-0x000001CE1A190000-0x000001CE1A1B2000-memory.dmp

Filesize
136KB

Download
memory/4260-0-0x00007FF96E5B3000-0x00007FF96E5B5000-memory.dmp

Filesize
8KB

Download
memory/4260-42-0x00007FF96E5B3000-0x00007FF96E5B5000-memory.dmp

Filesize
8KB

Download
memory/4260-1-0x00000000005E0000-0x000000000062C000-memory.dmp

Filesize
304KB

Download
memory/4260-59-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download
memory/4260-60-0x00007FF96E5B0000-0x00007FF96F072000-memory.dmp

Filesize
10.8MB

Download