| File name: | Solara V3.exe |
| Full analysis: | https://app.any.run/tasks/1aa0dde3-d4e0-4fd4-9fea-9c39c48c3da5 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | December 26, 2024, 18:03:38 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 5FDE7C6116CDF736F43946CA66D482E6 |
| SHA1: | CB7BDC719ED6D36D4A4F8F83A0572E448827D7A1 |
| SHA256: | FFF7969248D0015F01DB03330CC16A3A5168C05A997BBE6082EC412DAD64B871 |
| SSDEEP: | 768:T/v8Iox+PAKccJcZrNuPvQBK5wgFEPI9OsNz6QOBhuz8eR:T/v27sG3+zFr9dNz6QOB0H |
MALICIOUS
Changes the autorun value in the registry
- Solara V3.exe (PID: 3296)
Create files in the Startup directory
- Solara V3.exe (PID: 3296)
XWORM has been detected (YARA)
- Solara V3.exe (PID: 3296)
XWORM has been detected (SURICATA)
- Solara V3.exe (PID: 3296)
Connects to the CnC server
- Solara V3.exe (PID: 3296)
SUSPICIOUS
Checks for external IP
- svchost.exe (PID: 2192)
- Solara V3.exe (PID: 3296)
Executable content was dropped or overwritten
- Solara V3.exe (PID: 3296)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- Solara V3.exe (PID: 3296)
Connects to unusual port
- Solara V3.exe (PID: 3296)
Possible usage of Discord/Telegram API has been detected (YARA)
- Solara V3.exe (PID: 3296)
Contacting a server suspected of hosting an CnC
- Solara V3.exe (PID: 3296)
INFO
Reads the machine GUID from the registry
- Solara V3.exe (PID: 3296)
Reads the computer name
- Solara V3.exe (PID: 3296)
Checks supported languages
- Solara V3.exe (PID: 3296)
Reads Environment values
- Solara V3.exe (PID: 3296)
Disables trace logs
- Solara V3.exe (PID: 3296)
Checks proxy server information
- Solara V3.exe (PID: 3296)
Creates files or folders in the user directory
- Solara V3.exe (PID: 3296)
Reads the software policy settings
- Solara V3.exe (PID: 3296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(3296) Solara V3.exe
C2127.0.0.1,hojmj0e.localto.net,elmonba.localto.net:1578
Keys
AES<12345>
Options
Splitter<Xwormmm>
Sleep time3
USB drop namesolara
MutexTpRGbkymsDMZ1tod
ims-api
(PID) Process(3296) Solara V3.exe
Telegram-Tokens (1)7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8
Telegram-Info-Links
7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8
Get info about bothttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/getMe
Get incoming updateshttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/getUpdates
Get webhookhttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8
End-PointsendMessage
Args
chat_id (1)7367789454
text (1)☠ [XWorm V5.6]
New Clinet :
3C54740F7CC0F23B53E5
UserName : admin
OSFullName : Microsoft Windows 10 Pro
USB : False
CPU : Intel i5-6400 @ 2.70GHz
GPU : Microsoft Basic Display Adapter
RAM : 3.99 GB
Groub : solara HTTP/1.1
Host: api.telegram.org
Connection: Keep-Alive
Token7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8
End-PointsendMessage
Args
chat_id (1)7367789454
Token7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8
End-PointsendMessage
Args
chat_id (1)7367789454
text (1)☠ [XWorm V5.6]
New Clinet :
3C54740F7CC0F23B53E5
UserName : admin
OSFullName : Microsoft Windows 10
Telegram-Responses
oktrue
result
message_id1894
from
id7816963872
is_bottrue
first_namexw997yoniko
usernamexw997yoniko_bot
chat
id7367789454
first_namenko🇾🇪
last_name+44
usernamen44ko
typeprivate
date1735236230
text☠ [XWorm V5.6]
New Clinet :
3C54740F7CC0F23B53E5
UserName : admin
OSFullName : Microsoft Windows 10 Pro
USB : False
CPU : Intel i5-6400 @ 2.70GHz
GPU : Microsoft Basic Display Adapter
RAM : 3.99 GB
Groub : solara
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:12:22 09:42:42+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 44544 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xcc7e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | |
| FileVersion: | 1.0.0.0 |
| InternalName: | Solara.exe |
| LegalCopyright: | |
| OriginalFileName: | Solara.exe |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
126
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3296 | "C:\Users\admin\AppData\Local\Temp\Solara V3.exe" | C:\Users\admin\AppData\Local\Temp\Solara V3.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 1.0.0.0 Modules
XWorm(PID) Process(3296) Solara V3.exe C2127.0.0.1,hojmj0e.localto.net,elmonba.localto.net:1578 Keys AES<12345> Options Splitter<Xwormmm> Sleep time3 USB drop namesolara MutexTpRGbkymsDMZ1tod ims-api(PID) Process(3296) Solara V3.exe Telegram-Tokens (1)7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8 Telegram-Info-Links 7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8 Get info about bothttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/getMe Get incoming updateshttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/getUpdates Get webhookhttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/getWebhookInfo Delete webhookhttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/deleteWebhook Drop incoming updateshttps://api.telegram.org/bot7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8/deleteWebhook?drop_pending_updates=true Telegram-Requests Token7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8 End-PointsendMessage Args chat_id (1)7367789454 text (1)☠ [XWorm V5.6]
New Clinet :
3C54740F7CC0F23B53E5
UserName : admin
OSFullName : Microsoft Windows 10 Pro
USB : False
CPU : Intel i5-6400 @ 2.70GHz
GPU : Microsoft Basic Display Adapter
RAM : 3.99 GB
Groub : solara HTTP/1.1
Host: api.telegram.org
Connection: Keep-Alive Token7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8 End-PointsendMessage Args chat_id (1)7367789454 Token7816963872:AAGQ52nBkVFpDIav-p4t2fpmcE8lqIvhBK8 End-PointsendMessage Args chat_id (1)7367789454 text (1)☠ [XWorm V5.6]
New Clinet :
3C54740F7CC0F23B53E5
UserName : admin
OSFullName : Microsoft Windows 10 Telegram-Responses oktrue result message_id1894 from id7816963872 is_bottrue first_namexw997yoniko usernamexw997yoniko_bot chat id7367789454 first_namenko🇾🇪 last_name+44 usernamen44ko typeprivate date1735236230 text☠ [XWorm V5.6]
New Clinet :
3C54740F7CC0F23B53E5
UserName : admin
OSFullName : Microsoft Windows 10 Pro
USB : False
CPU : Intel i5-6400 @ 2.70GHz
GPU : Microsoft Basic Display Adapter
RAM : 3.99 GB
Groub : solara | |||||||||||||||
Total events
1 474
Read events
1 459
Write events
15
Delete events
0
Modification events
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (3296) Solara V3.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara V3_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3296 | Solara V3.exe | C:\Users\admin\dllhost | executable | |
MD5:5FDE7C6116CDF736F43946CA66D482E6 | SHA256:FFF7969248D0015F01DB03330CC16A3A5168C05A997BBE6082EC412DAD64B871 | |||
| 3296 | Solara V3.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.lnk | binary | |
MD5:68E56E80DA6877C5E05D76BDC71EE189 | SHA256:FC53F9FB6CA28EB0E7A3C7897F42AFF89E6BA7A1D51F09DF3A852F5AA139FAF1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
13
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.20.245.138:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
3296 | Solara V3.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 2.20.245.138:80 | crl.microsoft.com | Akamai International B.V. | SE | unknown |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
5064 | SearchApp.exe | 104.126.37.146:443 | www.bing.com | Akamai International B.V. | DE | unknown |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3296 | Solara V3.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | unknown |
4824 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3296 | Solara V3.exe | 149.154.167.220:443 | api.telegram.org | Telegram Messenger Inc | GB | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ip-api.com |
| shared |
api.telegram.org |
| shared |
login.live.com |
| whitelisted |
elmonba.localto.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
2192 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
3296 | Solara V3.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
3296 | Solara V3.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
2192 | svchost.exe | Misc activity | SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram |
2192 | svchost.exe | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |
3296 | Solara V3.exe | Misc activity | ET HUNTING Telegram API Certificate Observed |
3296 | Solara V3.exe | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |
3296 | Solara V3.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm Network Packet |
3 ETPRO signatures available at the full report