Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
29/06/2024, 14:29
General
- Target SolaraBootstrapper.exe
- Size 2.3MB
- Sample240629-rtj29ssdpq
- SHA256 902f94aa7222739a873f8f2805428e89822fc34842a0d731828ca0d6fce69dd6
Malware Config
Extracted
-
xworm
-
football-emily.gl.at.ply.gg:39625
-
Install_directory
%AppData%
-
install_file
Registry.exe
Signatures
- DcRat 2 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect Xworm Payload 4 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- DCRat payload 4 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 5 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 31 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Bootstrapper.exe"C:\Users\Admin\AppData\Roaming\Bootstrapper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Bootstrapper.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Bootstrapper.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Registry.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Registry.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Registry" /tr "C:\Users\Admin\AppData\Roaming\Registry.exe"3⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\ProgramData\Bootstrapper.exe"C:\ProgramData\Bootstrapper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SolaraBootstrapper.exe"C:\ProgramData\SolaraBootstrapper.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"C:\Users\Admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Boostraper.bat"C:\Users\Admin\AppData\Local\Temp\Boostraper.bat"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Media\fontreview.exe"C:\Media\fontreview.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Registry.exeC:\Users\Admin\AppData\Roaming\Registry.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Registry.exeC:\Users\Admin\AppData\Roaming\Registry.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3KNj5pJ.bat
TKlkLwYGTbrYwK.vbe
fontreview.exe
Bootstrapper.exe
SolaraBootstrapper.exe
Registry.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Boostraper.bat
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.WinForms.dll
Microsoft.Web.WebView2.Wpf.dll
.nycrc
.eslintrc
.nycrc
LICENSE
Newtonsoft.Json.dll
VCRUNTIME140.dll
WebView2Loader.dll
Wpf.Ui.dll
path.txt
cd57e4c171d6e8f5ea8b8f824a6a7316.dll
cd57e4c171d6e8f5ea8b8f824a6a7316.exe
libcurl.dll
zlib1.dll
__PSScriptPolicyTest_y50ge4ck.102.ps1
Bootstrapper.exe
memory/364-115-0x00000199EEDD0000-0x00000199EEDF2000-memory.dmp
memory/652-109-0x00007FFEE8D00000-0x00007FFEE97C1000-memory.dmp
memory/652-1646-0x00007FFEE8D00000-0x00007FFEE97C1000-memory.dmp
memory/652-1644-0x00007FFEE8D03000-0x00007FFEE8D05000-memory.dmp
memory/652-73-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/652-71-0x00007FFEE8D03000-0x00007FFEE8D05000-memory.dmp
memory/2832-1618-0x000001EBA36E0000-0x000001EBA379A000-memory.dmp
memory/2832-1642-0x000001EBA8AC0000-0x000001EBA8ACE000-memory.dmp
memory/2832-1625-0x000001EBA4610000-0x000001EBA468E000-memory.dmp
memory/2832-1614-0x000001EB89080000-0x000001EB8909A000-memory.dmp
memory/2832-1648-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/2832-1617-0x000001EBA3D00000-0x000001EBA423C000-memory.dmp
memory/2832-1643-0x000001EBA4240000-0x000001EBA440E000-memory.dmp
memory/2832-1623-0x000001EB8ADF0000-0x000001EB8ADFE000-memory.dmp
memory/2832-1636-0x0000000180000000-0x0000000180B0D000-memory.dmp
memory/2832-1641-0x000001EBA8AF0000-0x000001EBA8B28000-memory.dmp
memory/2832-1620-0x000001EBA38B0000-0x000001EBA3962000-memory.dmp
memory/2832-1640-0x000001EBA3C90000-0x000001EBA3C98000-memory.dmp
memory/3004-106-0x0000000000330000-0x0000000000442000-memory.dmp
memory/3004-107-0x0000000002560000-0x000000000256E000-memory.dmp
memory/4832-121-0x00000000057D0000-0x00000000057E2000-memory.dmp
memory/4832-102-0x0000000004CD0000-0x0000000004CDA000-memory.dmp
memory/4832-100-0x0000000000300000-0x000000000030A000-memory.dmp
memory/4900-0-0x0000000000400000-0x0000000000656000-memory.dmp
memory/4952-78-0x0000000000400000-0x0000000000422000-memory.dmp