Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
SolaraBootrapper.exe
Resource
win7-20240704-en
General
-
Target
SolaraBootrapper.exe
-
Size
64KB
-
MD5
774797464cf5376bb757bbef621f0887
-
SHA1
4f2e33f1d643487db43c7a9482a2839cb9bc1944
-
SHA256
6019a752eb6a130c3121fbcc23fe84ea8179374f3ce63e16009cbee672e5c469
-
SHA512
04d08bdfd52165105afdca03efc46f9a899d9acfc241d7a1b93bdca3becea91f7cd84716863dab60e9bebaad1d2ad243f869bcf20e781a3037be931bbbb6a611
-
SSDEEP
1536:2mL6HVloCyy5nVwiGfMOw0weB90trw42jU23utLF9pWzn:3L+vyyQi8w0weE9QUHvkn
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
192.168.0.23:6606
192.168.0.23:7707
192.168.0.23:8808
Anh14EOLKPzm
-
delay
3
-
install
false
-
install_file
SolaraBootstrapper.exe
-
install_folder
%AppData%
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2892 set thread context of 1280 2892 SolaraBootrapper.exe 87 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87 PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87 PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87 PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87 PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87 PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87 PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87 PID 2892 wrote to memory of 1280 2892 SolaraBootrapper.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootrapper.exe"2⤵PID:1280
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b5291f3dcf2c13784e09a057f2e43d13
SHA1fbb72f4b04269e0d35b1d9c29d02d63dbc7ad07e
SHA256ad995b51344d71019f96fc3a424de00256065daad8595ff599f6849c87ae75ce
SHA51211c89caac425bccaa24e2bb24c6f2b4e6d6863278bf8a5304a42bb44475b08ca586e09143e7d5b14db7f1cd9adacd5358769e0d999dc348073431031067bd4d4