Analysis
-
max time kernel
1049s -
max time network
526s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03/03/2025, 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BootStrapper.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
16 signatures
150 seconds
General
-
Target
BootStrapper.exe
-
Size
2.9MB
-
MD5
8828ce17966882f2e7ea3c2b81784b5e
-
SHA1
6c9f94b8caf056559a1d369afb79c15352437cba
-
SHA256
d07347612a8c2a0251dff5d9e0dd0cfbd525c420c8b6da1811737d7823332e3c
-
SHA512
d1deb6b1bb5fef47ba9a59d0c787bc76c8f623e5b5b7b510353189c29f1272f2434abb0af01428d323784107a4485ad1f4522e40c0dc604d6c4e6b64c6866c7c
-
SSDEEP
49152:xEUytQiBSHhKt8zXa1qH2L878d4Nmmev3Hsw1e27ACRIoHmEY3YZuhoo:CNtQlHh3X/2L/RmOswzAe+E/u9
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
Sihost.exe
-
pastebin_url
https://pastebin.com/raw/hA5YVNf1
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0009000000027f0c-4.dat family_xworm behavioral1/memory/3416-27-0x00000000002C0000-0x00000000002D8000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1252571373-3012572919-3982031544-1000\Control Panel\International\Geo\Nation BootStrapper.exe -
Executes dropped EXE 2 IoCs
pid Process 3416 Solara.exe 2352 BootstrapperNew.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootStrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3140 powershell.exe 3140 powershell.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4512 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 3416 Solara.exe Token: SeDebugPrivilege 3140 powershell.exe Token: SeIncreaseQuotaPrivilege 3140 powershell.exe Token: SeSecurityPrivilege 3140 powershell.exe Token: SeTakeOwnershipPrivilege 3140 powershell.exe Token: SeLoadDriverPrivilege 3140 powershell.exe Token: SeSystemProfilePrivilege 3140 powershell.exe Token: SeSystemtimePrivilege 3140 powershell.exe Token: SeProfSingleProcessPrivilege 3140 powershell.exe Token: SeIncBasePriorityPrivilege 3140 powershell.exe Token: SeCreatePagefilePrivilege 3140 powershell.exe Token: SeBackupPrivilege 3140 powershell.exe Token: SeRestorePrivilege 3140 powershell.exe Token: SeShutdownPrivilege 3140 powershell.exe Token: SeDebugPrivilege 3140 powershell.exe Token: SeSystemEnvironmentPrivilege 3140 powershell.exe Token: SeRemoteShutdownPrivilege 3140 powershell.exe Token: SeUndockPrivilege 3140 powershell.exe Token: SeManageVolumePrivilege 3140 powershell.exe Token: 33 3140 powershell.exe Token: 34 3140 powershell.exe Token: 35 3140 powershell.exe Token: 36 3140 powershell.exe Token: SeDebugPrivilege 4512 taskmgr.exe Token: SeSystemProfilePrivilege 4512 taskmgr.exe Token: SeCreateGlobalPrivilege 4512 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe 4512 taskmgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1184 wrote to memory of 3140 1184 BootStrapper.exe 84 PID 1184 wrote to memory of 3140 1184 BootStrapper.exe 84 PID 1184 wrote to memory of 3140 1184 BootStrapper.exe 84 PID 1184 wrote to memory of 3416 1184 BootStrapper.exe 86 PID 1184 wrote to memory of 3416 1184 BootStrapper.exe 86 PID 1184 wrote to memory of 2352 1184 BootStrapper.exe 87 PID 1184 wrote to memory of 2352 1184 BootStrapper.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe"C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAeQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAbQB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGgAZwB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAZwBxACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"2⤵
- Executes dropped EXE
PID:2352
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5f227cdfd423b3cc03bb69c49babf4da3
SHA13db5a97d9b0f2545e7ba97026af6c28512200441
SHA256cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8
SHA512b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e
-
Filesize
71KB
MD5b38c0370c3469a5ae8fa7b9ddf118871
SHA1d96824e898f284c3f84bc3248a3a473dbbbe98cd
SHA256d5391d1f5b68f622143c3a36e15e97702686b6206ddae3f7c4ef319a2f1d0ef6
SHA512f7b3f1f2c071f02173e04c6bd9506cd8cc11945ba5d9e761d6e3489edf31f5e30f1350722ec2deb7bc5c84d7889c181f42e12103ad015e0c8c5b2856ab5bf7ce
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82