Overview

overview

10

Static

static

10

X.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    896s
  • max time network
    898s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/03/2025, 16:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    X.exe

  • Size

    82KB

  • MD5

    b201ce5dcb58284da7a5ef6294418e56

  • SHA1

    27573051f80debfd74e1a72d27cfd29f58c76d7e

  • SHA256

    188d525daed5c014ea5ae62a1fd1841d783693e41712ea58b9906cda2b60dbed

  • SHA512

    f282f9efa40ce5e753faf803079af9aae478711e6e2f3dcf09c744ae3e670c6ef0cb18b62c8e57ba825faef8c396dd481768ef0680681d4b1b80ad1c3433f11c

  • SSDEEP

    1536:D2wgD0/WhgBpRCn3wtSD+bQ6QqTMj34Al6G4tIzOasNnP6UO:ywkeWQCn1+bQdjrytuOa6Sz

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:36623

fax-scenarios.gl.at.ply.gg:36623
Attributes
  • Install_directory

    %AppData%

  • install_file

    SolaraX.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 15 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\X.exe
    "C:\Users\Admin\AppData\Local\Temp\X.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\X.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2444
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SolaraX.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraX.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2904
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SolaraX" /tr "C:\Users\Admin\AppData\Roaming\SolaraX.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:988
    • C:\Windows\SYSTEM32\CMD.EXE
      "CMD.EXE"
      2⤵
      • Drops file in Drivers directory
      • Manipulates Digital Signatures
      • Boot or Logon Autostart Execution: Print Processors
      • Drops file in System32 directory
      • Modifies termsrv.dll
      PID:3752
    • C:\Windows\SYSTEM32\CMD.EXE
      "CMD.EXE"
      2⤵
        PID:4428
      • C:\Windows\SYSTEM32\CMD.EXE
        "CMD.EXE"
        2⤵
          PID:4996
        • C:\Windows\SYSTEM32\CMD.EXE
          "CMD.EXE"
          2⤵
          • Drops startup file
          PID:4604
      • C:\Users\Admin\AppData\Roaming\SolaraX.exe
        C:\Users\Admin\AppData\Roaming\SolaraX.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4824
      • C:\Users\Admin\AppData\Roaming\SolaraX.exe
        C:\Users\Admin\AppData\Roaming\SolaraX.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4700
      • C:\Users\Admin\AppData\Roaming\SolaraX.exe
        C:\Users\Admin\AppData\Roaming\SolaraX.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4136
      • C:\Users\Admin\AppData\Roaming\SolaraX.exe
        C:\Users\Admin\AppData\Roaming\SolaraX.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3876
      • C:\Users\Admin\AppData\Roaming\SolaraX.exe
        C:\Users\Admin\AppData\Roaming\SolaraX.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1196
      • C:\Users\Admin\AppData\Roaming\SolaraX.exe
        C:\Users\Admin\AppData\Roaming\SolaraX.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2280
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2848
      • C:\Users\Admin\AppData\Roaming\SolaraX.exe
        C:\Users\Admin\AppData\Roaming\SolaraX.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4380
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4612
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1488
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2408
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4800
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3856
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4332
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4612
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1152
        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          C:\Users\Admin\AppData\Roaming\SolaraX.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5040

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Print Processors

        1
        T1547.012

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Print Processors

        1
        T1547.012

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        3
        T1012

        System Information Discovery

        3
        T1082

        Lateral Movement

        Remote Services

        1
        T1021

        Remote Desktop Protocol

        1
        T1021.001

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SolaraX.exe.log
          Filesize

          654B

          MD5

          2ff39f6c7249774be85fd60a8f9a245e

          SHA1

          684ff36b31aedc1e587c8496c02722c6698c1c4e

          SHA256

          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

          SHA512

          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          440cb38dbee06645cc8b74d51f6e5f71

          SHA1

          d7e61da91dc4502e9ae83281b88c1e48584edb7c

          SHA256

          8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

          SHA512

          3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          4a154efa7af25bb8b94d0d9c7b4f15cd

          SHA1

          5e0e04103e4eef1bc7ef242b730aed1958f98e1f

          SHA256

          c216eda372556eb78e680bde247c2fd2085642ee33031905a213c6bec502ccce

          SHA512

          fc4678133318fe1952947be74e244246336c7faacc9b9ae32336d57b106ec8f044e5db41dd98e8f3a54270ddacab2fc84a66d5d67deeadc3056ea5213bcbbba4

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          ef72c47dbfaae0b9b0d09f22ad4afe20

          SHA1

          5357f66ba69b89440b99d4273b74221670129338

          SHA256

          692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

          SHA512

          7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          e5663972c1caaba7088048911c758bf3

          SHA1

          3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198

          SHA256

          9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e

          SHA512

          ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_epxk0pyg.xzo.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraX.lnk
          Filesize

          771B

          MD5

          e6842e36c5f2d693025dfbc5b46a3549

          SHA1

          0ee2912c387e78d6d016943e775cb4428f9200e5

          SHA256

          f5da451ba3402589344e9202ee5d72e77a22ee19e6961a6db522ee96363f07e9

          SHA512

          2ef4117aff7f1afe553777e1866ce510cdba47e2724b8ef7019836655127b6ec0d97945c90818304b0deef5a61cb88b29b2ce3b394b3dffbd8a38e9ffbd7e326

          Download Submit

        • C:\Users\Admin\AppData\Roaming\SolaraX.exe
          Filesize

          82KB

          MD5

          b201ce5dcb58284da7a5ef6294418e56

          SHA1

          27573051f80debfd74e1a72d27cfd29f58c76d7e

          SHA256

          188d525daed5c014ea5ae62a1fd1841d783693e41712ea58b9906cda2b60dbed

          SHA512

          f282f9efa40ce5e753faf803079af9aae478711e6e2f3dcf09c744ae3e670c6ef0cb18b62c8e57ba825faef8c396dd481768ef0680681d4b1b80ad1c3433f11c

          Download Submit

        • memory/2444-11-0x000002007F1B0000-0x000002007F1D2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2444-14-0x00007FFE1E8E0000-0x00007FFE1F3A1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2444-13-0x00007FFE1E8E0000-0x00007FFE1F3A1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2444-12-0x00007FFE1E8E0000-0x00007FFE1F3A1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2444-17-0x00007FFE1E8E0000-0x00007FFE1F3A1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3572-56-0x00007FFE1E8E3000-0x00007FFE1E8E5000-memory.dmp

          Filesize

          8KB

          Download

        • memory/3572-57-0x00007FFE1E8E0000-0x00007FFE1F3A1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3572-58-0x00007FFE1E8E0000-0x00007FFE1F3A1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3572-0-0x00007FFE1E8E3000-0x00007FFE1E8E5000-memory.dmp

          Filesize

          8KB

          Download

        • memory/3572-62-0x000000001D4C0000-0x000000001D4C8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/3572-66-0x000000001B610000-0x000000001B61A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/3572-68-0x000000001D4D0000-0x000000001D4DC000-memory.dmp

          Filesize

          48KB

          Download

        • memory/3572-1-0x0000000000990000-0x00000000009AA000-memory.dmp

          Filesize

          104KB

          Download