Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 20:37
Behavioral task
behavioral1
Sample
2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe
Resource
win7-20240220-en
General
-
Target
2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe
-
Size
47KB
-
MD5
c6f6dc7bba217c28483bf2d105cbfad2
-
SHA1
e09f5fb55ee7c3709c310d0882437ccc95d14acf
-
SHA256
2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044
-
SHA512
60d7cc4f0a9538b677a7ee71553ce0ea95d0225e68d60ea36ed931a3e6f6200a0b1ff5e77e1b9b488e1879b5d843f82a3893acf451977702dd154e649049c2a3
-
SSDEEP
768:4u1a71T3EiJfWUzDydmo2qz/0KuKbYWiDOQtPI9aygOB0KK60bNEyklQR/MVG4D7:4u1a71T3xq2+0KADXK9aC0KKlbNEXQR2
Malware Config
Extracted
asyncrat
0.5.8
Default
Y27AkfNWf4he
-
delay
3
-
install
true
-
install_file
Solara.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/UpAYSpm6
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Solara.exe family_asyncrat -
Detects file containing reversed ASEP Autorun registry keys 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1116-1-0x0000000000BC0000-0x0000000000BD2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse C:\Users\Admin\AppData\Roaming\Solara.exe INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe -
Executes dropped EXE 1 IoCs
Processes:
Solara.exepid process 3244 Solara.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 64 2.tcp.eu.ngrok.io 18 pastebin.com 19 pastebin.com 20 2.tcp.eu.ngrok.io 48 2.tcp.eu.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5028 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exepid process 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exeSolara.exedescription pid process Token: SeDebugPrivilege 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe Token: SeDebugPrivilege 3244 Solara.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.execmd.execmd.exedescription pid process target process PID 1116 wrote to memory of 2112 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe cmd.exe PID 1116 wrote to memory of 2112 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe cmd.exe PID 1116 wrote to memory of 2112 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe cmd.exe PID 1116 wrote to memory of 2304 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe cmd.exe PID 1116 wrote to memory of 2304 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe cmd.exe PID 1116 wrote to memory of 2304 1116 2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe cmd.exe PID 2304 wrote to memory of 5028 2304 cmd.exe timeout.exe PID 2304 wrote to memory of 5028 2304 cmd.exe timeout.exe PID 2304 wrote to memory of 5028 2304 cmd.exe timeout.exe PID 2112 wrote to memory of 1768 2112 cmd.exe schtasks.exe PID 2112 wrote to memory of 1768 2112 cmd.exe schtasks.exe PID 2112 wrote to memory of 1768 2112 cmd.exe schtasks.exe PID 2304 wrote to memory of 3244 2304 cmd.exe Solara.exe PID 2304 wrote to memory of 3244 2304 cmd.exe Solara.exe PID 2304 wrote to memory of 3244 2304 cmd.exe Solara.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe"C:\Users\Admin\AppData\Local\Temp\2cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Solara" /tr '"C:\Users\Admin\AppData\Roaming\Solara.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Solara" /tr '"C:\Users\Admin\AppData\Roaming\Solara.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp565D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Solara.exe"C:\Users\Admin\AppData\Roaming\Solara.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp565D.tmp.batFilesize
150B
MD53bffe5f5fbf25e56e206a590a67cddbf
SHA1ec7f2f1805f27ec6d956bbb4da5785a934243e8c
SHA256fe1c27a4ea41fee1671ec529f92488e19a6d36432216ec18d1161ffcaeea2977
SHA51281ee7ad8fa62989ecb4deb7cc437a0df1cb57407c24cb3788a672ea7ad2a1a005aa9836ac3f10830bd3f61cd203c5f50dd05f62bd949c754615801aba9cc1f2c
-
C:\Users\Admin\AppData\Roaming\Solara.exeFilesize
47KB
MD5c6f6dc7bba217c28483bf2d105cbfad2
SHA1e09f5fb55ee7c3709c310d0882437ccc95d14acf
SHA2562cb3ccdd4a695657e2a4a73147070f2c724d3ec1e9b1febddc4774643eeaa044
SHA51260d7cc4f0a9538b677a7ee71553ce0ea95d0225e68d60ea36ed931a3e6f6200a0b1ff5e77e1b9b488e1879b5d843f82a3893acf451977702dd154e649049c2a3
-
memory/1116-0-0x00000000750AE000-0x00000000750AF000-memory.dmpFilesize
4KB
-
memory/1116-1-0x0000000000BC0000-0x0000000000BD2000-memory.dmpFilesize
72KB
-
memory/1116-2-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/1116-3-0x0000000005410000-0x0000000005476000-memory.dmpFilesize
408KB
-
memory/1116-4-0x00000000058D0000-0x000000000596C000-memory.dmpFilesize
624KB
-
memory/1116-10-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/3244-14-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/3244-15-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB