Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 14:57
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
Solara.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
General
-
Target
Solara.exe
-
Size
10.8MB
-
MD5
f20115143f1188ffd1d835013c5c09d5
-
SHA1
6561d192eef5e283cf684d59c29fe36aac8011db
-
SHA256
f08fb57935598eb57b2b1f46f2cf1cafb7abe84db8870b0283ead4f63e1f7360
-
SHA512
41235c73e25513a24e887dda389b88520f5398da7a20b39aac068f994b1cfe068d50772b8a34d9ae37e0b68ba4482e238489b613b44a281664b955a8135428e2
-
SSDEEP
196608:ehgy6EPAsulmtSHeNvX+wfm/pf+xfdkRYDKsnarvOv0DaZbH:7ZQtSUvX+9/pWFGRJsnarvzaFH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2660 Solara.exe -
resource yara_rule behavioral1/files/0x0005000000019314-46.dat upx -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1736 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2660 2416 Solara.exe 28 PID 2416 wrote to memory of 2660 2416 Solara.exe 28 PID 2416 wrote to memory of 2660 2416 Solara.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"2⤵
- Loads dropped DLL
PID:2660
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45