Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SolaraBootrapper.exe
Resource
win7-20240704-en
3 signatures
150 seconds
General
-
Target
SolaraBootrapper.exe
-
Size
64KB
-
MD5
774797464cf5376bb757bbef621f0887
-
SHA1
4f2e33f1d643487db43c7a9482a2839cb9bc1944
-
SHA256
6019a752eb6a130c3121fbcc23fe84ea8179374f3ce63e16009cbee672e5c469
-
SHA512
04d08bdfd52165105afdca03efc46f9a899d9acfc241d7a1b93bdca3becea91f7cd84716863dab60e9bebaad1d2ad243f869bcf20e781a3037be931bbbb6a611
-
SSDEEP
1536:2mL6HVloCyy5nVwiGfMOw0weB90trw42jU23utLF9pWzn:3L+vyyQi8w0weE9QUHvkn
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
192.168.0.23:6606
192.168.0.23:7707
192.168.0.23:8808
Mutex
Anh14EOLKPzm
Attributes
-
delay
3
-
install
false
-
install_file
SolaraBootstrapper.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 560 set thread context of 2784 560 SolaraBootrapper.exe 29 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29 PID 560 wrote to memory of 2784 560 SolaraBootrapper.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"2⤵PID:2784
-