Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 21:05
Behavioral task
behavioral1
Sample
SolaraFixTool.exe
Resource
win7-20240611-en
General
-
Target
SolaraFixTool.exe
-
Size
7.3MB
-
MD5
9972ed676b1428b586b733f51e357d01
-
SHA1
e4b85c269771a39b54cf23ac5ef1f6acdd609faa
-
SHA256
2322592cef7efc479cc8d3c41334272d1141e306b94fec5f81ef0a573c1add97
-
SHA512
90d634c1fceba0c5348c3511c03c8841c55f8e94f0af710f1c5746fc3d294037462f7ec377fe88fb035fe036b2cf59f71507e3316bdb33acab2fdcbeae967ec3
-
SSDEEP
196608:F6YS6HOshoKMuIkhVastRL5Di3u41D7dJq:sYSqOshouIkPftRL54VRDq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
SolaraFixTool.exepid process 2052 SolaraFixTool.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI22082\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SolaraFixTool.exedescription pid process target process PID 2208 wrote to memory of 2052 2208 SolaraFixTool.exe SolaraFixTool.exe PID 2208 wrote to memory of 2052 2208 SolaraFixTool.exe SolaraFixTool.exe PID 2208 wrote to memory of 2052 2208 SolaraFixTool.exe SolaraFixTool.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraFixTool.exe"C:\Users\Admin\AppData\Local\Temp\SolaraFixTool.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\SolaraFixTool.exe"C:\Users\Admin\AppData\Local\Temp\SolaraFixTool.exe"2⤵
- Loads dropped DLL
PID:2052
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab