Overview
overview
10Static
static
3SolarB.exe
windows10-1703-x64
10$TEMP/Cd
windows10-1703-x64
1$TEMP/Chi
windows10-1703-x64
1$TEMP/Complaints
windows10-1703-x64
1$TEMP/Cosmetic
windows10-1703-x64
1$TEMP/Dash
windows10-1703-x64
1$TEMP/Efficiently
windows10-1703-x64
1$TEMP/Emphasis
windows10-1703-x64
1$TEMP/Enjoyed
windows10-1703-x64
1$TEMP/Event
windows10-1703-x64
1$TEMP/Flights
windows10-1703-x64
1$TEMP/Fragrances
windows10-1703-x64
1$TEMP/Granted
windows10-1703-x64
1$TEMP/Graph
windows10-1703-x64
1$TEMP/He
windows10-1703-x64
1$TEMP/Healing
windows10-1703-x64
1$TEMP/Leave
windows10-1703-x64
1$TEMP/Maybe
windows10-1703-x64
1$TEMP/Nike
windows10-1703-x64
1$TEMP/Original
windows10-1703-x64
1$TEMP/Pb
windows10-1703-x64
1$TEMP/Pounds
windows10-1703-x64
1$TEMP/Scholars
windows10-1703-x64
1$TEMP/Shakira
windows10-1703-x64
1$TEMP/Sheer
windows10-1703-x64
1$TEMP/Ski
windows10-1703-x64
1$TEMP/Surname
windows10-1703-x64
1$TEMP/Tab
windows10-1703-x64
1$TEMP/Usd
windows10-1703-x64
1$TEMP/Vegetable
windows10-1703-x64
1Static task
static1
Behavioral task
behavioral1
Sample
SolarB.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
$TEMP/Cd
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
$TEMP/Chi
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
$TEMP/Complaints
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
$TEMP/Cosmetic
Resource
win10-20240611-en
Behavioral task
behavioral6
Sample
$TEMP/Dash
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
$TEMP/Efficiently
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
$TEMP/Emphasis
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
$TEMP/Enjoyed
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
$TEMP/Event
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
$TEMP/Flights
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
$TEMP/Fragrances
Resource
win10-20240611-en
Behavioral task
behavioral13
Sample
$TEMP/Granted
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
$TEMP/Graph
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
$TEMP/He
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
$TEMP/Healing
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
$TEMP/Leave
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
$TEMP/Maybe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
$TEMP/Nike
Resource
win10-20240611-en
Behavioral task
behavioral20
Sample
$TEMP/Original
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
$TEMP/Pb
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
$TEMP/Pounds
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
$TEMP/Scholars
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
$TEMP/Shakira
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
$TEMP/Sheer
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
$TEMP/Ski
Resource
win10-20240611-en
Behavioral task
behavioral27
Sample
$TEMP/Surname
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
$TEMP/Tab
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
$TEMP/Usd
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
$TEMP/Vegetable
Resource
win10-20240404-en
General
-
Target
SolarB.exe
-
Size
250.0MB
-
MD5
daedd0adf5c3350ae5a16312887c0d72
-
SHA1
2ed4ec4419988106f6ed577e0df423bdb902eb11
-
SHA256
998ae90e88e1810bccb2378e6f023348d407829d09a5b21110dfdaddd3d6ead6
-
SHA512
e3c69d322497993531182e0baf2f23537edc4d5cbc23ce5e8e8a77d5f76bf82995568bb37f00258b42f902ec52c675b0b5fb2c8098f4c92aee67224935e94503
-
SSDEEP
24576:cgkBhqECQiwDnaBCAhA3mmLBJ3OBqaPzrcw8oVfwlas:cgujMu1WN8w8oVfD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SolarB.exe
Files
-
SolarB.exe.exe windows:4 windows x86 arch:x86
c05041e01f84e1ccca9c4451f3b6a383
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
SetWindowPos
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersion
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
ExitProcess
CopyFileW
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$TEMP/Cd
-
$TEMP/Chi
-
$TEMP/Complaints
-
$TEMP/Cosmetic
-
$TEMP/Dash
-
$TEMP/Efficiently
-
$TEMP/Emphasis
-
$TEMP/Enjoyed
-
$TEMP/Event
-
$TEMP/Flights
-
$TEMP/Fragrances
-
$TEMP/Granted
-
$TEMP/Graph
-
$TEMP/He
-
$TEMP/Healing
-
$TEMP/Leave
-
$TEMP/Maybe
-
$TEMP/Nike
-
$TEMP/Original
-
$TEMP/Pb
-
$TEMP/Pounds
-
$TEMP/Scholars
-
$TEMP/Shakira
-
$TEMP/Sheer
-
$TEMP/Ski
-
$TEMP/Surname
-
$TEMP/Tab
-
$TEMP/Usd
-
$TEMP/Vegetable