Overview
overview
8Static
static
7trojan-lea...um.exe
windows10-1703-x64
8trojan-lea...um.exe
windows7-x64
8trojan-lea...um.exe
windows10-2004-x64
8trojan-lea....0.z01
windows10-1703-x64
3trojan-lea....0.z01
windows7-x64
3trojan-lea....0.z01
windows10-2004-x64
trojan-lea....0.z02
windows10-1703-x64
3trojan-lea....0.z02
windows7-x64
3trojan-lea....0.z02
windows10-2004-x64
3trojan-lea....0.zip
windows10-1703-x64
1trojan-lea....0.zip
windows7-x64
1trojan-lea....0.zip
windows10-2004-x64
trojan-lea....0.z01
windows10-1703-x64
3trojan-lea....0.z01
windows7-x64
3trojan-lea....0.z01
windows10-2004-x64
3trojan-lea....0.z02
windows10-1703-x64
3trojan-lea....0.z02
windows7-x64
3trojan-lea....0.z02
windows10-2004-x64
trojan-lea....0.z03
windows10-1703-x64
3trojan-lea....0.z03
windows7-x64
3trojan-lea....0.z03
windows10-2004-x64
trojan-lea....0.zip
windows10-1703-x64
1trojan-lea....0.zip
windows7-x64
1trojan-lea....0.zip
windows10-2004-x64
trojan-lea...ty.exe
windows10-1703-x64
1trojan-lea...ty.exe
windows7-x64
1trojan-lea...ty.exe
windows10-2004-x64
1trojan-lea...n).rar
windows10-1703-x64
3trojan-lea...n).rar
windows7-x64
3trojan-lea...n).rar
windows10-2004-x64
3Resubmissions
09-05-2023 19:22
230509-x3fn4adg58 1009-05-2023 19:14
230509-xxsrgaff7x 1009-05-2023 19:14
230509-xxr5yadg42 709-05-2023 19:14
230509-xxrt6sff7w 809-05-2023 19:14
230509-xxrjeaff7v 809-05-2023 19:14
230509-xxqxwadg39 709-05-2023 19:14
230509-xxql4sff7t 1009-05-2023 19:14
230509-xxqbcadg38 709-05-2023 19:10
230509-xvl6xadf64 10Analysis
-
max time kernel
244s -
max time network
423s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-05-2023 19:14
Behavioral task
behavioral1
Sample
trojan-leaks-main/Ruthenium/Ruthenium.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
trojan-leaks-main/Ruthenium/Ruthenium.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
trojan-leaks-main/Ruthenium/Ruthenium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
trojan-leaks-main/Solaris 2.0.z01
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
trojan-leaks-main/Solaris 2.0.z01
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
trojan-leaks-main/Solaris 2.0.z01
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
trojan-leaks-main/Solaris 2.0.z02
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
trojan-leaks-main/Solaris 2.0.z02
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
trojan-leaks-main/Solaris 2.0.z02
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
trojan-leaks-main/Solaris 2.0.zip
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
trojan-leaks-main/Solaris 2.0.zip
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
trojan-leaks-main/Solaris 2.0.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
trojan-leaks-main/Solaris2.0.z01
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
trojan-leaks-main/Solaris2.0.z01
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
trojan-leaks-main/Solaris2.0.z01
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
trojan-leaks-main/Solaris2.0.z02
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
trojan-leaks-main/Solaris2.0.z02
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
trojan-leaks-main/Solaris2.0.z02
Resource
win10v2004-20230221-en
Behavioral task
behavioral19
Sample
trojan-leaks-main/Solaris2.0.z03
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
trojan-leaks-main/Solaris2.0.z03
Resource
win7-20230220-en
Behavioral task
behavioral21
Sample
trojan-leaks-main/Solaris2.0.z03
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
trojan-leaks-main/Solaris2.0.zip
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
trojan-leaks-main/Solaris2.0.zip
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
trojan-leaks-main/Solaris2.0.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
trojan-leaks-main/Suffocate-safety.exe
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
trojan-leaks-main/Suffocate-safety.exe
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
trojan-leaks-main/Suffocate-safety.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
trojan-leaks-main/TheEchoOfFear (Special Edition).rar
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
trojan-leaks-main/TheEchoOfFear (Special Edition).rar
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
trojan-leaks-main/TheEchoOfFear (Special Edition).rar
Resource
win10v2004-20230220-en
General
-
Target
trojan-leaks-main/Solaris 2.0.z01
-
Size
24.0MB
-
MD5
785e18d17f4e2134d93c51fe3d5ee6b1
-
SHA1
aa00b501547ce619b158d7ea6bdad104b3db00a4
-
SHA256
9579c6d8e98d60688af84034100c1fb1e242f5c1b7a3ab44544200d600b85154
-
SHA512
9c4f1b0d3f654fe72c461b0eb248866882ec45c1bcdb2cdd9851a1996246e528d475a2b9730cc893d2ccb2b1b1961864225e5dc4e6db20cbd828547d3a178eae
-
SSDEEP
393216:liBze+O0D+RHt7n2TUw46vYVk+FAAznp157iqvpQzE6zOYImu3sUs+md46GYJAcj:lU0++JvwnQ/FAALBiopQzE6qYI9Pm66f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\z01_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\z01_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.z01\ = "z01_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\z01_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\.z01 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\z01_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\z01_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\z01_auto_file rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 632 AcroRd32.exe 632 AcroRd32.exe 632 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1976 wrote to memory of 864 1976 cmd.exe rundll32.exe PID 1976 wrote to memory of 864 1976 cmd.exe rundll32.exe PID 1976 wrote to memory of 864 1976 cmd.exe rundll32.exe PID 864 wrote to memory of 632 864 rundll32.exe AcroRd32.exe PID 864 wrote to memory of 632 864 rundll32.exe AcroRd32.exe PID 864 wrote to memory of 632 864 rundll32.exe AcroRd32.exe PID 864 wrote to memory of 632 864 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Solaris 2.0.z01"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Solaris 2.0.z012⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Solaris 2.0.z01"3⤵
- Suspicious use of SetWindowsHookEx
PID:632
-
-