Analysis

  • max time kernel
    10s
  • max time network
    20s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 15:51

General

  • Target

    SolarisBETA/Solaris.exe

  • Size

    143KB

  • MD5

    f8cc2b58cec9e31bf803fae2e4f46bfa

  • SHA1

    b2ffd2d4288b141e35e732f85e4949b4ed7b4820

  • SHA256

    365dc0f2d75a3468ba97b0e4f262b34b3e42c0f8085c0cf6c4745abd1cab2b75

  • SHA512

    d243e216bde8a8265b21923a1268de8b7665cbc6b547edcfc96b3d5883475980d9a870c6c9e3de523bd42dd8815648a43c739157cad3aa3f205555252e6e72a9

  • SSDEEP

    3072:ErHyYbtwcPYv4DlyzCk/2WlguRdLDhwHeL7nxZUvXvtaIA2XP7XXADPG:ErHRbtwcPYv4DlyzCk/zguRvL7xwcIA7

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\Solaris.exe
    "C:\Users\Admin\AppData\Local\Temp\SolarisBETA\Solaris.exe"
    1⤵
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log" --mojo-platform-channel-handle=2220 --field-trial-handle=2252,i,15428082323580238118,7950626216133277469,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2 --host-process-id=692
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2504
    • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log" --mojo-platform-channel-handle=2872 --field-trial-handle=2252,i,15428082323580238118,7950626216133277469,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8 --host-process-id=692
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1364
    • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log" --mojo-platform-channel-handle=3124 --field-trial-handle=2252,i,15428082323580238118,7950626216133277469,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8 --host-process-id=692
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:904
    • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=2252,i,15428082323580238118,7950626216133277469,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --host-process-id=692 /prefetch:1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3276
    • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=2252,i,15428082323580238118,7950626216133277469,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --host-process-id=692 /prefetch:1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:540
    • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe
      "C:\Users\Admin\AppData\Local\Temp\SolarisBETA\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3536 --field-trial-handle=2252,i,15428082323580238118,7950626216133277469,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --host-process-id=692 /prefetch:1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1500

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log

          Filesize

          23KB

          MD5

          59767cc760f74eb15ad772793761b411

          SHA1

          7e6830208855f2e6e906a6cac558015300281d75

          SHA256

          9c52c9945a696b05ebfcb21ee3215e7169dc88f7bb636dc62389c2009dd2c623

          SHA512

          712945a4149c79235799a4e871b762ced4f034c322552e2b806e9bb0092303b5661f53fc3dae239fa084a0f9f7048a34dfe300c2df2d1762a584fb4a5b427450

        • C:\Users\Admin\AppData\Local\Temp\SolarisBETA\debug.log

          Filesize

          23KB

          MD5

          1f53a8701353680b43843487c56662c2

          SHA1

          1a26adbecd066ad9b8fb8478ef311f58a30e3c9d

          SHA256

          f9a59b2f6f18bbea5690dcbbe233a185936275ca409540193d624bc902201f45

          SHA512

          0ad36f9eec8b0246bb0a17485d490f0e5fa68dda7aa5debd8b0db4881ffbb0559408885433f8d059fe0accb04c29abf55944bd532b9439e3bdedba2ceefffeeb

        • memory/692-17-0x00007FFAD9580000-0x00007FFADA041000-memory.dmp

          Filesize

          10.8MB

        • memory/692-0-0x0000020693230000-0x0000020693258000-memory.dmp

          Filesize

          160KB

        • memory/692-4-0x00000206ADC10000-0x00000206ADC24000-memory.dmp

          Filesize

          80KB

        • memory/692-5-0x00000206AEDD0000-0x00000206AEEB0000-memory.dmp

          Filesize

          896KB

        • memory/692-6-0x00000206AEA70000-0x00000206AEABA000-memory.dmp

          Filesize

          296KB

        • memory/692-7-0x00000206B01E0000-0x00000206B03A1000-memory.dmp

          Filesize

          1.8MB

        • memory/692-36-0x00007FFAD9580000-0x00007FFADA041000-memory.dmp

          Filesize

          10.8MB

        • memory/692-1-0x00007FFAD9583000-0x00007FFAD9585000-memory.dmp

          Filesize

          8KB

        • memory/692-16-0x00000206B1F20000-0x00000206B1F96000-memory.dmp

          Filesize

          472KB

        • memory/692-14-0x00000206B1E60000-0x00000206B1F12000-memory.dmp

          Filesize

          712KB

        • memory/692-3-0x00007FFAD9580000-0x00007FFADA041000-memory.dmp

          Filesize

          10.8MB

        • memory/692-2-0x00000206ADC80000-0x00000206ADE94000-memory.dmp

          Filesize

          2.1MB

        • memory/692-31-0x00000206B2410000-0x00000206B2432000-memory.dmp

          Filesize

          136KB

        • memory/692-32-0x00000206B23E0000-0x00000206B23FE000-memory.dmp

          Filesize

          120KB

        • memory/2504-15-0x000001EDA6A00000-0x000001EDA6B1F000-memory.dmp

          Filesize

          1.1MB

        • memory/2504-13-0x000001EDA4C80000-0x000001EDA4C86000-memory.dmp

          Filesize

          24KB