Overview
overview
10Static
static
7SolaraBETA...ker.js
windows7-x64
3SolaraBETA...ker.js
windows10-2004-x64
3SolaraBETA...ode.js
windows7-x64
3SolaraBETA...ode.js
windows10-2004-x64
3SolaraBETA...ker.js
windows7-x64
3SolaraBETA...ker.js
windows10-2004-x64
3SolaraBETA...ode.js
windows7-x64
3SolaraBETA...ode.js
windows10-2004-x64
3SolaraBETA...ker.js
windows7-x64
3SolaraBETA...ker.js
windows10-2004-x64
3SolaraBETA...ces.js
windows7-x64
3SolaraBETA...ces.js
windows10-2004-x64
3SolaraBETA...ode.js
windows7-x64
3SolaraBETA...ode.js
windows10-2004-x64
3SolaraBETA...ker.js
windows7-x64
3SolaraBETA...ker.js
windows10-2004-x64
3SolaraBETA...der.js
windows7-x64
3SolaraBETA...der.js
windows10-2004-x64
3SolaraBETA...on.dll
windows7-x64
1SolaraBETA...on.dll
windows10-2004-x64
1SolaraBETA...er.dll
windows7-x64
1SolaraBETA...er.dll
windows10-2004-x64
1SolaraBETA...Ui.dll
windows7-x64
1SolaraBETA...Ui.dll
windows10-2004-x64
1SolaraBETA...Na.dll
windows7-x64
9SolaraBETA...Na.dll
windows10-2004-x64
9SolaraBETA...Na.exe
windows7-x64
10SolaraBETA...Na.exe
windows10-2004-x64
10SolaraBETA...pet.js
windows7-x64
3SolaraBETA...pet.js
windows10-2004-x64
3SolaraBETA...-0.dll
windows10-2004-x64
1SolaraBETA...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 16:42
Behavioral task
behavioral1
Sample
SolaraBETA3/Monaco/vs/language/css/cssworker.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SolaraBETA3/Monaco/vs/language/css/cssworker.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
SolaraBETA3/Monaco/vs/language/html/htmlmode.js
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SolaraBETA3/Monaco/vs/language/html/htmlmode.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
SolaraBETA3/Monaco/vs/language/html/htmlworker.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
SolaraBETA3/Monaco/vs/language/html/htmlworker.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
SolaraBETA3/Monaco/vs/language/json/jsonmode.js
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
SolaraBETA3/Monaco/vs/language/json/jsonmode.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
SolaraBETA3/Monaco/vs/language/json/jsonworker.js
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
SolaraBETA3/Monaco/vs/language/json/jsonworker.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
SolaraBETA3/Monaco/vs/language/typescript/lib/typescriptservices.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
SolaraBETA3/Monaco/vs/language/typescript/lib/typescriptservices.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
SolaraBETA3/Monaco/vs/language/typescript/tsmode.js
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
SolaraBETA3/Monaco/vs/language/typescript/tsmode.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
SolaraBETA3/Monaco/vs/language/typescript/tsworker.js
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
SolaraBETA3/Monaco/vs/language/typescript/tsworker.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
SolaraBETA3/Monaco/vs/loader.js
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
SolaraBETA3/Monaco/vs/loader.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
SolaraBETA3/Newtonsoft.Json.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
SolaraBETA3/Newtonsoft.Json.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
SolaraBETA3/WebView2Loader.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
SolaraBETA3/WebView2Loader.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
SolaraBETA3/Wpf.Ui.dll
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
SolaraBETA3/Wpf.Ui.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
SolaraBETA3/XcHvYYrNa.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
SolaraBETA3/XcHvYYrNa.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
SolaraBETA3/XcHvYYrNa.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
SolaraBETA3/XcHvYYrNa.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
SolaraBETA3/XcHvYYrNa.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.52/adblock_snippet.js
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
SolaraBETA3/XcHvYYrNa.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.52/adblock_snippet.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
SolaraBETA3/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
SolaraBETA3/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20240508-en
General
-
Target
SolaraBETA3/XcHvYYrNa.dll
-
Size
5.2MB
-
MD5
85b0dcb64053e35280477d88e1e05505
-
SHA1
70ebc4da4ac422bb47c1c49114d935d01848436b
-
SHA256
0c11716983653fef7d0f403c31429d9730c3c182eecc2e518ab98b4de6dd6730
-
SHA512
2f79e49f093fd0aaef79cbda75924ddec34a8172182a5cb7ddcde5227897f46e9e55dccf310779918afd1144f2af9a003d58939b5e631ecda147c81b95ad4d64
-
SSDEEP
98304:Hjq4IKpMF9j28xRr3gylwOjA3iquS4+RUk2o9/C/omTI:Dq7sMTj2w0yGyGKzmC/om
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Processes:
resource yara_rule behavioral25/memory/3068-0-0x0000000180000000-0x0000000180C2E000-memory.dmp themida behavioral25/memory/3068-1-0x0000000180000000-0x0000000180C2E000-memory.dmp themida behavioral25/memory/3068-3-0x0000000180000000-0x0000000180C2E000-memory.dmp themida behavioral25/memory/3068-2-0x0000000180000000-0x0000000180C2E000-memory.dmp themida behavioral25/memory/3068-5-0x0000000180000000-0x0000000180C2E000-memory.dmp themida behavioral25/memory/3068-6-0x0000000180000000-0x0000000180C2E000-memory.dmp themida behavioral25/memory/3068-7-0x0000000180000000-0x0000000180C2E000-memory.dmp themida -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 3068 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SolaraBETA3\XcHvYYrNa.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3068-0-0x0000000180000000-0x0000000180C2E000-memory.dmpFilesize
12.2MB
-
memory/3068-1-0x0000000180000000-0x0000000180C2E000-memory.dmpFilesize
12.2MB
-
memory/3068-3-0x0000000180000000-0x0000000180C2E000-memory.dmpFilesize
12.2MB
-
memory/3068-2-0x0000000180000000-0x0000000180C2E000-memory.dmpFilesize
12.2MB
-
memory/3068-4-0x0000000077A80000-0x0000000077A82000-memory.dmpFilesize
8KB
-
memory/3068-5-0x0000000180000000-0x0000000180C2E000-memory.dmpFilesize
12.2MB
-
memory/3068-6-0x0000000180000000-0x0000000180C2E000-memory.dmpFilesize
12.2MB
-
memory/3068-7-0x0000000180000000-0x0000000180C2E000-memory.dmpFilesize
12.2MB