Overview
overview
8Static
static
3SOLARAUPDATE.zip
windows7-x64
1SOLARAUPDATE.zip
windows10-2004-x64
1SOLARAUPDA...AB.exe
windows7-x64
7SOLARAUPDA...AB.exe
windows10-2004-x64
8SOLARAB.pyc
windows7-x64
3SOLARAB.pyc
windows10-2004-x64
3SOLARAUPDA...st.txt
windows7-x64
1SOLARAUPDA...st.txt
windows10-2004-x64
1SOLARAUPDA...s.json
windows7-x64
3SOLARAUPDA...s.json
windows10-2004-x64
3SOLARAUPDA...au.dll
windows7-x64
1SOLARAUPDA...au.dll
windows10-2004-x64
1SOLARAUPDA...e.json
windows7-x64
3SOLARAUPDA...e.json
windows10-2004-x64
3SOLARAUPDA...st.lua
windows7-x64
3SOLARAUPDA...st.lua
windows10-2004-x64
3SOLARAUPDA...le.txt
windows7-x64
1SOLARAUPDA...le.txt
windows10-2004-x64
1SOLARAUPDA...et.txt
windows7-x64
1SOLARAUPDA...et.txt
windows10-2004-x64
1SOLARAUPDA...le.txt
windows7-x64
1SOLARAUPDA...le.txt
windows10-2004-x64
1SOLARAUPDA..._1.txt
windows7-x64
1SOLARAUPDA..._1.txt
windows10-2004-x64
1SOLARAUPDA..._2.txt
windows7-x64
1SOLARAUPDA..._2.txt
windows10-2004-x64
1SOLARAUPDA...le.txt
windows7-x64
1SOLARAUPDA...le.txt
windows10-2004-x64
1SOLARAUPDA...le.txt
windows7-x64
1SOLARAUPDA...le.txt
windows10-2004-x64
1SOLARAUPDA...tefile
windows7-x64
1SOLARAUPDA...tefile
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 12:23
Behavioral task
behavioral1
Sample
SOLARAUPDATE.zip
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
SOLARAUPDATE.zip
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
SOLARAUPDATED/SOLARAB.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SOLARAUPDATED/SOLARAB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SOLARAB.pyc
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
SOLARAB.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
SOLARAUPDATED/autoexecute/test.txt
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
SOLARAUPDATED/autoexecute/test.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
SOLARAUPDATED/bin/api-docs.json
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
SOLARAUPDATED/bin/api-docs.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
SOLARAUPDATED/bin/incognito-luau.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
SOLARAUPDATED/bin/incognito-luau.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
SOLARAUPDATED/bin/save.json
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
SOLARAUPDATED/bin/save.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
SOLARAUPDATED/scripts/test.lua
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
SOLARAUPDATED/scripts/test.lua
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
SOLARAUPDATED/workspace/.tests/appendfile.txt
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
SOLARAUPDATED/workspace/.tests/appendfile.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
SOLARAUPDATED/workspace/.tests/getcustomasset.txt
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
SOLARAUPDATED/workspace/.tests/getcustomasset.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
SOLARAUPDATED/workspace/.tests/isfile.txt
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
SOLARAUPDATED/workspace/.tests/isfile.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
SOLARAUPDATED/workspace/.tests/listfiles/test_1.txt
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
SOLARAUPDATED/workspace/.tests/listfiles/test_1.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
SOLARAUPDATED/workspace/.tests/listfiles/test_2.txt
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
SOLARAUPDATED/workspace/.tests/listfiles/test_2.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
SOLARAUPDATED/workspace/.tests/loadfile.txt
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
SOLARAUPDATED/workspace/.tests/loadfile.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
SOLARAUPDATED/workspace/.tests/readfile.txt
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
SOLARAUPDATED/workspace/.tests/readfile.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
SOLARAUPDATED/workspace/.tests/writefile
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
SOLARAUPDATED/workspace/.tests/writefile
Resource
win10v2004-20240508-en
General
-
Target
SOLARAB.pyc
-
Size
44KB
-
MD5
0b4fbb0e2121e8d85e9e324307b2f186
-
SHA1
fc14e82fb8ad20db541a650c8b3f377683079e15
-
SHA256
b2a3b5f61d94decaa3e4bf6fd9d4836525413b75d9c11370cfbb84a2a89d8d03
-
SHA512
42a8a9cc7d0c3da2188251e5457de364040f2024800b885d9d18cc96d46da447fdcda53090ed925089de7191f206a310b4edd4f0ddf271b63f0ca407fd138485
-
SSDEEP
768:n9JWQMr0q6nEPqm0HSmwUqRe8Ie2cxtaaEws4YHE6D9fJOyeWDlhLx3+pJ6y:n9JWh4q6noqmI+1Rr6cxRPeEuTdNDlho
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2672 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2672 AcroRd32.exe 2672 AcroRd32.exe 2672 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1680 wrote to memory of 3036 1680 cmd.exe rundll32.exe PID 1680 wrote to memory of 3036 1680 cmd.exe rundll32.exe PID 1680 wrote to memory of 3036 1680 cmd.exe rundll32.exe PID 3036 wrote to memory of 2672 3036 rundll32.exe AcroRd32.exe PID 3036 wrote to memory of 2672 3036 rundll32.exe AcroRd32.exe PID 3036 wrote to memory of 2672 3036 rundll32.exe AcroRd32.exe PID 3036 wrote to memory of 2672 3036 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SOLARAB.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SOLARAB.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SOLARAB.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5edbd5eb877df1be8761feb2472410935
SHA144b36b7377005b83d383012427c305e7aa7df596
SHA2569642fb253b3c8f19d1e1efdd20e81eae2b88864f5a68123fee700877d6a7ef3d
SHA512ece45ca9fdba6b42decf72787d778e4f0da3dd4f0ee30cb351e98a1e786dafcf5a9a5e3a761ce92819791ea34a9f8fbdb080d054fed69970c30e2778a3a6b503