xworm | 4d3101ba1ec70ddd04a30b6f04a67817920a6601e477339e5c135c167f6ab1e2

General

Target

Solara.exe
Size

45KB
MD5

04f89f83ba27038601e2321b08d0b4ca
SHA1

edecd6d74ac90bbd235334ee17c2cae0ababa51b
SHA256

4d3101ba1ec70ddd04a30b6f04a67817920a6601e477339e5c135c167f6ab1e2
SHA512

04aece7190c9731d3a3528ef4b762eb47db6b50f670201dad4cd98c8bdf389eb1c8671488b550b02b28ae8ae61685ef0929b0a05273f09114b0e45269e4514bf
SSDEEP

768:fvn+LJZ2ny8BcGhsWc3cQHqGbgEbFEP89ObA6BOuh3zjjU:fHABTMmq6FN9UA6BOuFE

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

george-liechtenstein.gl.at.ply.gg:2030

Mutex

OSPDmToN2pBX1fa2

Attributes

Install_directory
%AppData%
install_file
Windows Defender.exe

aes.plain

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2888-36-0x0000000002190000-0x000000000219E000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2888-1-0x0000000000B00000-0x0000000000B12000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.exe
1840	powershell.exe
2800	powershell.exe
2628	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	Solara.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	Solara.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender.exe"	Solara.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1840	powershell.exe
2800	powershell.exe
2628	powershell.exe
2560	powershell.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe
2888	Solara.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	Solara.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2888	Solara.exe
Token: SeShutdownPrivilege	2888	Solara.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2888	Solara.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1840	2888	Solara.exe	32
PID 2888 wrote to memory of 1840	2888	Solara.exe	32
PID 2888 wrote to memory of 1840	2888	Solara.exe	32
PID 2888 wrote to memory of 2800	2888	Solara.exe	34
PID 2888 wrote to memory of 2800	2888	Solara.exe	34
PID 2888 wrote to memory of 2800	2888	Solara.exe	34
PID 2888 wrote to memory of 2628	2888	Solara.exe	36
PID 2888 wrote to memory of 2628	2888	Solara.exe	36
PID 2888 wrote to memory of 2628	2888	Solara.exe	36
PID 2888 wrote to memory of 2560	2888	Solara.exe	38
PID 2888 wrote to memory of 2560	2888	Solara.exe	38
PID 2888 wrote to memory of 2560	2888	Solara.exe	38

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Defender.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e244215947b137de1cf3c5dba0fc2f24

SHA1
26cb162b889fdf973655e6912716c43b40738955

SHA256
d0c9198ccba0cd4b569537665ef6976d217feec72304da0d38ad42cae9a0a89b

SHA512
f1ece0d85d24206fa7c4c22f10e11dcdc534855d33fa32a6b6cd14b2867970a0fd542dba5a9a9ff0f2cc840e9855fb0297c2cbe7b25fcb5c784844337c268319

Download Submit
memory/1840-7-0x0000000002A30000-0x0000000002AB0000-memory.dmp

Filesize
512KB

Download
memory/1840-8-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/1840-9-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2800-15-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2800-16-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/2888-2-0x000007FEF63F0000-0x000007FEF6DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2888-0-0x000007FEF63F3000-0x000007FEF63F4000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000000B00000-0x0000000000B12000-memory.dmp

Filesize
72KB

Download
memory/2888-27-0x000007FEF63F3000-0x000007FEF63F4000-memory.dmp

Filesize
4KB

Download
memory/2888-32-0x000007FEF63F0000-0x000007FEF6DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2888-33-0x0000000001F50000-0x0000000001F5C000-memory.dmp

Filesize
48KB

Download
memory/2888-36-0x0000000002190000-0x000000000219E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads