Analysis
-
max time kernel
10s -
max time network
13s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-07-2024 05:14
General
-
Target
SolaraB.exe
-
Size
229KB
-
MD5
48baa0394f0e53ec2e19d99a3b98a400
-
SHA1
723638a8779f3ed8d195fdc1af92bd2036ec1ca6
-
SHA256
186b386185fc93d31a827f9a711ceb0134e85cd91acf0d8b622b891bda751e79
-
SHA512
eeab39f6d51059f79d0372cd0b1c2197ac08f53a94068b070a63c28344a92e8d4f521e6b0f0a172e950fcbd17c22a707a7d0cbad3209669b868822651b023c53
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4G//Hdtxd38e1m+Ji:noZtL+EP8ovnxZe
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/952-0-0x000001D756A90000-0x000001D756AD0000-memory.dmp family_umbral -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 32 powershell.exe 4920 powershell.exe 3536 powershell.exe 5060 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts SolaraB.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 discord.com 6 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3552 cmd.exe 4352 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4052 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4352 PING.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 952 SolaraB.exe 32 powershell.exe 32 powershell.exe 4920 powershell.exe 4920 powershell.exe 3536 powershell.exe 3536 powershell.exe 1028 powershell.exe 1028 powershell.exe 5060 powershell.exe 5060 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 952 SolaraB.exe Token: SeIncreaseQuotaPrivilege 656 wmic.exe Token: SeSecurityPrivilege 656 wmic.exe Token: SeTakeOwnershipPrivilege 656 wmic.exe Token: SeLoadDriverPrivilege 656 wmic.exe Token: SeSystemProfilePrivilege 656 wmic.exe Token: SeSystemtimePrivilege 656 wmic.exe Token: SeProfSingleProcessPrivilege 656 wmic.exe Token: SeIncBasePriorityPrivilege 656 wmic.exe Token: SeCreatePagefilePrivilege 656 wmic.exe Token: SeBackupPrivilege 656 wmic.exe Token: SeRestorePrivilege 656 wmic.exe Token: SeShutdownPrivilege 656 wmic.exe Token: SeDebugPrivilege 656 wmic.exe Token: SeSystemEnvironmentPrivilege 656 wmic.exe Token: SeRemoteShutdownPrivilege 656 wmic.exe Token: SeUndockPrivilege 656 wmic.exe Token: SeManageVolumePrivilege 656 wmic.exe Token: 33 656 wmic.exe Token: 34 656 wmic.exe Token: 35 656 wmic.exe Token: 36 656 wmic.exe Token: SeIncreaseQuotaPrivilege 656 wmic.exe Token: SeSecurityPrivilege 656 wmic.exe Token: SeTakeOwnershipPrivilege 656 wmic.exe Token: SeLoadDriverPrivilege 656 wmic.exe Token: SeSystemProfilePrivilege 656 wmic.exe Token: SeSystemtimePrivilege 656 wmic.exe Token: SeProfSingleProcessPrivilege 656 wmic.exe Token: SeIncBasePriorityPrivilege 656 wmic.exe Token: SeCreatePagefilePrivilege 656 wmic.exe Token: SeBackupPrivilege 656 wmic.exe Token: SeRestorePrivilege 656 wmic.exe Token: SeShutdownPrivilege 656 wmic.exe Token: SeDebugPrivilege 656 wmic.exe Token: SeSystemEnvironmentPrivilege 656 wmic.exe Token: SeRemoteShutdownPrivilege 656 wmic.exe Token: SeUndockPrivilege 656 wmic.exe Token: SeManageVolumePrivilege 656 wmic.exe Token: 33 656 wmic.exe Token: 34 656 wmic.exe Token: 35 656 wmic.exe Token: 36 656 wmic.exe Token: SeDebugPrivilege 32 powershell.exe Token: SeDebugPrivilege 4920 powershell.exe Token: SeDebugPrivilege 3536 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeIncreaseQuotaPrivilege 3672 wmic.exe Token: SeSecurityPrivilege 3672 wmic.exe Token: SeTakeOwnershipPrivilege 3672 wmic.exe Token: SeLoadDriverPrivilege 3672 wmic.exe Token: SeSystemProfilePrivilege 3672 wmic.exe Token: SeSystemtimePrivilege 3672 wmic.exe Token: SeProfSingleProcessPrivilege 3672 wmic.exe Token: SeIncBasePriorityPrivilege 3672 wmic.exe Token: SeCreatePagefilePrivilege 3672 wmic.exe Token: SeBackupPrivilege 3672 wmic.exe Token: SeRestorePrivilege 3672 wmic.exe Token: SeShutdownPrivilege 3672 wmic.exe Token: SeDebugPrivilege 3672 wmic.exe Token: SeSystemEnvironmentPrivilege 3672 wmic.exe Token: SeRemoteShutdownPrivilege 3672 wmic.exe Token: SeUndockPrivilege 3672 wmic.exe Token: SeManageVolumePrivilege 3672 wmic.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 952 wrote to memory of 656 952 SolaraB.exe 81 PID 952 wrote to memory of 656 952 SolaraB.exe 81 PID 952 wrote to memory of 1072 952 SolaraB.exe 84 PID 952 wrote to memory of 1072 952 SolaraB.exe 84 PID 952 wrote to memory of 32 952 SolaraB.exe 86 PID 952 wrote to memory of 32 952 SolaraB.exe 86 PID 952 wrote to memory of 4920 952 SolaraB.exe 88 PID 952 wrote to memory of 4920 952 SolaraB.exe 88 PID 952 wrote to memory of 3536 952 SolaraB.exe 90 PID 952 wrote to memory of 3536 952 SolaraB.exe 90 PID 952 wrote to memory of 1028 952 SolaraB.exe 92 PID 952 wrote to memory of 1028 952 SolaraB.exe 92 PID 952 wrote to memory of 3672 952 SolaraB.exe 94 PID 952 wrote to memory of 3672 952 SolaraB.exe 94 PID 952 wrote to memory of 1644 952 SolaraB.exe 96 PID 952 wrote to memory of 1644 952 SolaraB.exe 96 PID 952 wrote to memory of 1648 952 SolaraB.exe 98 PID 952 wrote to memory of 1648 952 SolaraB.exe 98 PID 952 wrote to memory of 5060 952 SolaraB.exe 100 PID 952 wrote to memory of 5060 952 SolaraB.exe 100 PID 952 wrote to memory of 4052 952 SolaraB.exe 102 PID 952 wrote to memory of 4052 952 SolaraB.exe 102 PID 952 wrote to memory of 3552 952 SolaraB.exe 104 PID 952 wrote to memory of 3552 952 SolaraB.exe 104 PID 3552 wrote to memory of 4352 3552 cmd.exe 106 PID 3552 wrote to memory of 4352 3552 cmd.exe 106 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1072 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"2⤵
- Views/modifies file attributes
PID:1072
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraB.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1644
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:4052
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\SolaraB.exe" && pause2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4352
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:104
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
948B
MD5a0e27123ec2730bd5d89828fd6a41cc2
SHA1d1099e93025598a470d6cc9c0549595e8f8e9a7f
SHA256fda70f35a9cbde9e93461cd72d0c668f964d8b07e5c43322e47ed602ceb177a9
SHA512b73fba4357362fa2057fe5216490da71958e1edb6fd08fe7cd99d214a8a1a5381ff304584c7969cedfb790170ecd65cbe96e006c5d2e41ceff587138ba244d31
-
Filesize
1KB
MD57332074ae2b01262736b6fbd9e100dac
SHA122f992165065107cc9417fa4117240d84414a13c
SHA256baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA5124ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2
-
Filesize
1KB
MD5623edc19594c7e9cb1958ff7004b2194
SHA1219f235fcd160655042cddea3f28f4c5b3b4570d
SHA256ce721349257d0e1e1c9ec58980598346336fdefb36762f5d074322e59f5ce949
SHA512556ecc312e7fae6aa394db0b5b6e75032e566f9b75c7a267a9b2e4cefbd1271d0a87dd325fcda9d1f6648ff4eee9cd5e96fd0901c09d229214ad9cbf55590ff9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82