Analysis
- max time kernel
147s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/05/2024, 17:49
General
- Target SolaraB/Solara/SolaraBootstrapper.exe
- Size 12KB
- Sample240521-weabqsdc65
- SHA256 3e4f692506d372bebc12d344c5f1543b67fa1dbe095c910aab78456510d7fe66
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB\Solara\SolaraBootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\XcHvYYrNa.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1304,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.Wpf.dll
.nycrc
.eslintrc
.nycrc
LICENSE
Wpf.Ui.dll
XcHvYYrNa.dll
XcHvYYrNa.exe
libcurl.dll
WebView2Loader.dll
vcruntime140.dll
zlib1.dll
memory/4728-1476-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4728-5-0x00000000059D0000-0x00000000059E2000-memory.dmp
memory/4728-3-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4728-2-0x0000000004ED0000-0x0000000004EDA000-memory.dmp
memory/4728-1-0x0000000000740000-0x000000000074A000-memory.dmp
memory/4728-0-0x000000007446E000-0x000000007446F000-memory.dmp
memory/5084-1486-0x000002516C000000-0x000002516C00E000-memory.dmp
memory/5084-1503-0x0000000180000000-0x0000000180C2E000-memory.dmp
memory/5084-1482-0x000002516EFE0000-0x000002516F09A000-memory.dmp
memory/5084-1481-0x000002516F610000-0x000002516FB4C000-memory.dmp
memory/5084-1480-0x00007FF8AD530000-0x00007FF8ADFF1000-memory.dmp
memory/5084-1478-0x000002516BC10000-0x000002516BC2A000-memory.dmp
memory/5084-1477-0x00007FF8AD533000-0x00007FF8AD535000-memory.dmp
memory/5084-1499-0x0000000180000000-0x0000000180C2E000-memory.dmp
memory/5084-1501-0x00007FF8BEA30000-0x00007FF8BEA54000-memory.dmp
memory/5084-1500-0x0000000180000000-0x0000000180C2E000-memory.dmp
memory/5084-1502-0x0000000180000000-0x0000000180C2E000-memory.dmp
memory/5084-1484-0x000002516F2C0000-0x000002516F33E000-memory.dmp
memory/5084-1504-0x0000000180000000-0x0000000180C2E000-memory.dmp
memory/5084-1505-0x000002516F590000-0x000002516F598000-memory.dmp
memory/5084-1507-0x000002516FD80000-0x000002516FD8E000-memory.dmp
memory/5084-1506-0x000002516FDC0000-0x000002516FDF8000-memory.dmp
memory/5084-1508-0x0000000180000000-0x0000000180C2E000-memory.dmp
memory/5084-1510-0x00007FF8AD533000-0x00007FF8AD535000-memory.dmp
memory/5084-1511-0x00007FF8AD530000-0x00007FF8ADFF1000-memory.dmp
memory/5084-1532-0x0000000180000000-0x0000000180C2E000-memory.dmp
memory/5084-1534-0x0000000180000000-0x0000000180C2E000-memory.dmp