Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/08/2024, 15:18
General
-
Target
Solara/Solara.dll
-
Size
4.4MB
-
MD5
a53cf82436dfac0fda9e01183a722670
-
SHA1
8c8d115de8d37fcd67f7492d7e787226e33a83b2
-
SHA256
c59e574dea69bfd4cff31d338b65968c2b90a3de7331acbeb00bd67561598f8a
-
SHA512
f724cc057e3597e2817646235afe3b56fab7e62e35a78cb1817cf56c152a0b8e172081e23d2f18003417a92a16f54f7d11ce3c70ae124048a0ce90b9b415652e
-
SSDEEP
98304:lk5QmmwKHEPKtxHsVGGK0XIbNJ4RCiwGIn3qWvBe4teHtDSf:lkfmzrHEKOyvQaaceHtM
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Solara\Solara.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.3MB
-
Filesize
8KB
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
144KB
-
Filesize
11.3MB