Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 04:08
Behavioral task
behavioral1
Sample
SolaraPatcher.exe
Resource
win7-20240221-en
General
-
Target
SolaraPatcher.exe
-
Size
7.4MB
-
MD5
902e0f28a81ee39249980688b971cfde
-
SHA1
1075f10cdceee85ce1ed919e6e51507f3ba20c41
-
SHA256
81ad8c3a50477ab2151c4cdc3472b380e97c30e6cb96b37da23402d3d5ec85a7
-
SHA512
4ec54f872761630dff223c117b0b7630f796a810c06d28446187de29f93da63b3ef3991e95a699c6c050c565374e1e7a8de5f637f654f7385dfd32e8c2d22e68
-
SSDEEP
98304:/IeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbdv9JTSPhlVtQo1fw:/VYmOshoKMuIkhVastRL5Di3tK1SPJw
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
SolaraPatcher.exepid process 2564 SolaraPatcher.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI20682\python311.dll upx behavioral1/memory/2564-23-0x000007FEF6130000-0x000007FEF6719000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SolaraPatcher.exedescription pid process target process PID 2068 wrote to memory of 2564 2068 SolaraPatcher.exe SolaraPatcher.exe PID 2068 wrote to memory of 2564 2068 SolaraPatcher.exe SolaraPatcher.exe PID 2068 wrote to memory of 2564 2068 SolaraPatcher.exe SolaraPatcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"2⤵
- Loads dropped DLL
PID:2564
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2440
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab