fe278313e0c1881d20de92eb25d7d54c3889302ab41a6dfd4bce7ef09ba1634a

Analysis

max time kernel
11s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraBootrapper.exe
Size

456KB
MD5

f69ce486fdd380c2555229632782cf33
SHA1

2d0fcc652f0ed2ef98a6ca79267fe5ade3bfc2f3
SHA256

fe278313e0c1881d20de92eb25d7d54c3889302ab41a6dfd4bce7ef09ba1634a
SHA512

37282041ba015c96b1db8fb156e3f28504d0266154e255c041dfc26b83358ec005e34c2e25b34650b0eb7700746639c6a7bbc68da2655a5ab8aec4e3f6d29f66
SSDEEP

6144:ravR0hfwk3QY6sk2exgDe6VlWT8b90K1rBofjXz/b34nuM+V:GvGBZ3HDtrDPVle8HBo/LGuM4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	SolaraBootrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Solara.exe

Executes dropped EXE 3 IoCs

pid	Process
4892	Solara.exe
2612	sheet.exe
1972	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Loads dropped DLL 1 IoCs

pid	Process
1972	cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	Solara.exe
4892	Solara.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	Solara.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4892	4880	SolaraBootrapper.exe	80
PID 4880 wrote to memory of 4892	4880	SolaraBootrapper.exe	80
PID 4880 wrote to memory of 4892	4880	SolaraBootrapper.exe	80
PID 4880 wrote to memory of 2612	4880	SolaraBootrapper.exe	82
PID 4880 wrote to memory of 2612	4880	SolaraBootrapper.exe	82
PID 4892 wrote to memory of 1972	4892	Solara.exe	87
PID 4892 wrote to memory of 1972	4892	Solara.exe	87

C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1972
- C:\Users\Admin\AppData\Local\Temp\sheet.exe
  "C:\Users\Admin\AppData\Local\Temp\sheet.exe"
  2⤵
  - Executes dropped EXE
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll

Filesize
488KB

MD5
851fee9a41856b588847cf8272645f58

SHA1
ee185a1ff257c86eb19d30a191bf0695d5ac72a1

SHA256
5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca

SHA512
cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll

Filesize
43KB

MD5
34ec990ed346ec6a4f14841b12280c20

SHA1
6587164274a1ae7f47bdb9d71d066b83241576f0

SHA256
1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409

SHA512
b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc

Filesize
139B

MD5
d0104f79f0b4f03bbcd3b287fa04cf8c

SHA1
54f9d7adf8943cb07f821435bb269eb4ba40ccc2

SHA256
997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a

SHA512
daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc

Filesize
43B

MD5
c28b0fe9be6e306cc2ad30fe00e3db10

SHA1
af79c81bd61c9a937fca18425dd84cdf8317c8b9

SHA256
0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641

SHA512
e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc

Filesize
216B

MD5
c2ab942102236f987048d0d84d73d960

SHA1
95462172699187ac02eaec6074024b26e6d71cff

SHA256
948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

SHA512
e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE

Filesize
1KB

MD5
13babc4f212ce635d68da544339c962b

SHA1
4881ad2ec8eb2470a7049421047c6d076f48f1de

SHA256
bd47ce7b88c7759630d1e2b9fcfa170a0f1fde522be09e13fb1581a79d090400

SHA512
40e30174433408e0e2ed46d24373b12def47f545d9183b7bce28d4ddd8c8bb528075c7f20e118f37661db9f1bba358999d81a14425eb3e0a4a20865dfcb53182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll

Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Filesize
85KB

MD5
f8f4522d11178a26e97e2046f249dfa7

SHA1
8b591d9a37716e235260fb6b3f601e4ccbebf15d

SHA256
3c372a8919c28dc76414b2f30da423c3e1018b1a8444527949ce20cc3fc93ed0

SHA512
52ea881cad501cf1d5e8ac47355e862ac1bd39cb6e1ff3d362d392b6f2d676e74878832505d17a552aaa3bc8f3977da11fa3f9903722eedd23716fb46ddb7492

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.exe

Filesize
13KB

MD5
6557bd5240397f026e675afb78544a26

SHA1
839e683bf68703d373b6eac246f19386bb181713

SHA256
a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

SHA512
f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\sheet.exe

Filesize
433KB

MD5
402639a1710f03cec323ff691008a9c2

SHA1
68b0e8ee94202b557d0de55d74d52c74be18fe4d

SHA256
fe093da74277c5ccc6665bf3df01741d69f2bef1c164b3e5fbd940ca7e616ce1

SHA512
1ce7c47bb2e09ba6b45479ef0ff384389674cbaee5721c2cd5718245a41fb9906e56aa58ecee8ed7a2ab86c86113e7b0cc6fadc4421ae337cc0ada7d9a74f10f

Download Submit
memory/1972-1500-0x000001CECD4A0000-0x000001CECD9DC000-memory.dmp

Filesize
5.2MB

Download
memory/1972-1501-0x000001CECD150000-0x000001CECD20A000-memory.dmp

Filesize
744KB

Download
memory/1972-1505-0x000001CEB1690000-0x000001CEB169E000-memory.dmp

Filesize
56KB

Download
memory/1972-1498-0x000001CEB12A0000-0x000001CEB12BA000-memory.dmp

Filesize
104KB

Download
memory/1972-1503-0x000001CECD210000-0x000001CECD28E000-memory.dmp

Filesize
504KB

Download
memory/2612-23-0x0000000000140000-0x00000000001B2000-memory.dmp

Filesize
456KB

Download
memory/2612-22-0x00007FFAA59E3000-0x00007FFAA59E5000-memory.dmp

Filesize
8KB

Download
memory/4880-21-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4892-1497-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4892-25-0x000000007513E000-0x000000007513F000-memory.dmp

Filesize
4KB

Download
memory/4892-26-0x0000000000D80000-0x0000000000D8A000-memory.dmp

Filesize
40KB

Download
memory/4892-31-0x0000000006150000-0x0000000006162000-memory.dmp

Filesize
72KB

Download
memory/4892-28-0x0000000005650000-0x000000000565A000-memory.dmp

Filesize
40KB

Download
memory/4892-29-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download