Analysis
-
max time kernel
34s -
max time network
41s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-07-2024 15:08
Behavioral task
behavioral1
Sample
SolaraB.exe
Resource
win11-20240709-en
General
-
Target
SolaraB.exe
-
Size
78KB
-
MD5
7d9783a23f84206f2e5f83cc020f3339
-
SHA1
5d4e5122cac946766db4ad62dec9a38ac0c440f0
-
SHA256
cf5f5f7b6931de3ca12d8ba0628a7a7fbade9666f28b5399636e9b7462ffc77a
-
SHA512
af4a184d2fd23ed06b3fee32be763b1e13558f957634cf5f0183c3330aebe3f05ebea077f2348dfdbaf537c3c494ad5f1292ed7ce7cf71ffd8bd4adbc1b47dc5
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+UPIC:5Zv5PDwbjNrmAE+IIC
Malware Config
Extracted
discordrat
-
discord_token
MTI0NjEzNDA1Nzg1MTY4Njk4NA.GRF2kh.kub45g__zske6ArznkMfWRakUQokgM9wnBNeco
-
server_id
1246129266614210684
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops file in Windows directory 1 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133651841385832194" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2976 chrome.exe 2976 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
SolaraB.exechrome.exedescription pid process Token: SeDebugPrivilege 3396 SolaraB.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeCreatePagefilePrivilege 2976 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2976 wrote to memory of 2036 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2036 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 3116 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 4144 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 4144 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe PID 2976 wrote to memory of 2556 2976 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff882d0cc40,0x7ff882d0cc4c,0x7ff882d0cc582⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1808 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2116 /prefetch:32⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3208 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3348 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4416 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4616,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4872,i,14423858307893955905,11703234393254606066,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4888 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
356B
MD505af83a69a372abd34e52d37e4f8e196
SHA168670d4cddc6705bf3358be16f8940ad2860053f
SHA256421ad80ac60a6176aacedd5559babbd1750e6c4351f05dd8e376efdbacb77286
SHA512db42cf1dab1a1968460e8ad1b9cc152665ec974fd5c148f20c4bbd05047884258284176ef4613bcac5313ebf778463878267914e046ef240de75673120b2e969
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD5898d0e791b16e58b7aa6624074f1efc5
SHA1e1f84c20345f6b2ea0640135df60bd5d9368584b
SHA25670f3d64f5556fbf6692fa355c708f44726e40bca45bc1372cc3608b020e67a12
SHA512599f33e0188cd7abc0d62c4b98d3225eaad03231e3bec90cc4eea07030563cb5efc8694ba7ee7f43634f95653d0f5ae5fb823502a9540d37670da9ebc0f15368
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
181KB
MD57861c7f6f76c17f08ec0ee6198903caa
SHA1978257ae59efb38b9131833d60ae1114b0d7a2a5
SHA256878706608f1b9cc7799b16a156df20f85ad82f38c1daff9ceebd3ace8e846792
SHA5124bf75406d006d70897d0be7dcdb8ef8cb3897af8bdddcfba6ebe520b2d2f3c0dfd0ee823b580bc261cf125df54688d54c2cc7a88be2c5a561d889230bc1657ec
-
\??\pipe\crashpad_2976_SHLOVXYSLNYOXJKSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3396-0-0x00007FF887553000-0x00007FF887555000-memory.dmpFilesize
8KB
-
memory/3396-1-0x000001C5E6CB0000-0x000001C5E6CC8000-memory.dmpFilesize
96KB
-
memory/3396-2-0x000001C5E93D0000-0x000001C5E9592000-memory.dmpFilesize
1.8MB
-
memory/3396-3-0x00007FF887550000-0x00007FF888012000-memory.dmpFilesize
10.8MB
-
memory/3396-4-0x000001C5EA650000-0x000001C5EAB78000-memory.dmpFilesize
5.2MB
-
memory/3396-5-0x00007FF887553000-0x00007FF887555000-memory.dmpFilesize
8KB
-
memory/3396-30-0x00007FF887550000-0x00007FF888012000-memory.dmpFilesize
10.8MB