Overview

overview

10

Static

static

3

S0laradD/S0LaraV.exe

windows7-x64

10

S0laradD/S0LaraV.exe

windows10-2004-x64

10

S0laradD/libEGL.dll

windows7-x64

1

S0laradD/libEGL.dll

windows10-2004-x64

1

S0laradD/l...de.ps1

windows7-x64

3

S0laradD/l...de.ps1

windows10-2004-x64

3

S0laradD/l...m.html

windows7-x64

3

S0laradD/l...m.html

windows10-2004-x64

3

S0laradD/l...ng.dll

windows7-x64

1

S0laradD/l...ng.dll

windows10-2004-x64

1

S0laradD/l...ng.dll

windows7-x64

1

S0laradD/l...ng.dll

windows10-2004-x64

1

S0laradD/l...ng.dll

windows7-x64

1

S0laradD/l...ng.dll

windows10-2004-x64

1

S0laradD/l...47.dll

windows10-2004-x64

1

S0laradD/l...de.ps1

windows7-x64

3

S0laradD/l...de.ps1

windows10-2004-x64

3

S0laradD/l...eg.dll

windows7-x64

1

S0laradD/l...eg.dll

windows10-2004-x64

1

S0laradD/l....1.dll

windows7-x64

1

S0laradD/l....1.dll

windows10-2004-x64

1

S0laradD/l...er.dll

windows7-x64

1

S0laradD/l...er.dll

windows10-2004-x64

1

S0laradD/l...-1.dll

windows7-x64

1

S0laradD/l...-1.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4af97f359c0001cb6ff0ec2eb8c2893a9e8c96134e026fa35b0f04bbc299a7f9

  • Size

    53.2MB

  • Sample

    240805-1dgfwasglf

  • MD5

    8c20c552124c5505b4e5e939b5f68733

  • SHA1

    cab4f3dd2282c1daac69e427e49f38570755afc0

  • SHA256

    4af97f359c0001cb6ff0ec2eb8c2893a9e8c96134e026fa35b0f04bbc299a7f9

  • SHA512

    3cf946c061735cec56c1337950e1f5bdfdb6bd33a4ad418fdd4cd02b853a140af2ab2967c34f2b99b65951c66ba9bf8dbe0d8ed8b0d45f08ebb07928dd1013a1

  • SSDEEP

    1572864:v+TUpGGlqG7zVpKSLrjOvswzWg5ROfqKktuYGjkS:GTaZ/7znjftqKkuiS

Score
10/10
credential_accessdiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      S0laradD/S0LaraV.exe

    • Size

      1.4MB

    • MD5

      94f25f446b0b21ffd82fd8b219c7a86f

    • SHA1

      50ba95c6e5f0960f5cec57047376f8f11192afdc

    • SHA256

      b297d84e4632df8b18e650e51928e05789179cd364efe12411e8aeb4f77ba7e7

    • SHA512

      18c08c452d5441aad7c0dc98fcfc6a1213a8a159ea5a5eff9d413c96dccf10eb8195e56c304ffebf8b3e50136daf73ea0ec823206505e997cbf035b031e4f6d2

    • SSDEEP

      24576:Mwbdw0IY9Dy8Y7Twhp3XyANDB/EVCpIwtwjzSnRHLHU+mJpSaGchS9dVMF:LbdR9nY7UhZXyAlB/EsWjjzSRL0hSaTv

    Score
    10/10
    credential_accessdiscoveryspywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

    • Target

      S0laradD/libEGL.dll

    • Size

      485KB

    • MD5

      7b93aa2d3f49e88cb26fcfc0897073f5

    • SHA1

      119156600f2b4e1c07c7aa4907888662bf288cae

    • SHA256

      fd40b70086569b0298292e838e9d2ea2394304116705289e0666694429752870

    • SHA512

      78d996c33efc74dec54067765921d0690e4cfe8c63953c27e61b28b1bf9a8e6e25967694c00de1fb2cbec11e8c110d048c11d23ed337563b993c01d341a23491

    • SSDEEP

      6144:f3rGS+e87yDqHfFetvM/jvtGgJ53B6Zj8s1al2zl0ovk1SA7eSY/L8iAYu:TGS+e87A6eZM/jvtGgJZB6ZirS04LQB

    Score
    1/10
    behavioral3behavioral4

    • Target

      S0laradD/locales/locales/de.pak

    • Size

      367KB

    • MD5

      cfc9d90273c31ccf66d81739aa76306a

    • SHA1

      ecab570041654b147b3dd118829e2f7ae668f840

    • SHA256

      8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a

    • SHA512

      c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380

    • SSDEEP

      6144:F+QNkAjzYyqSFaPjON3Be0mzBWCj0Xs5HgIxBI0gql:cQLjMyvFaCN3mzBd5xy0gql

    Score
    3/10
    execution
    behavioral5behavioral6

    • Target

      S0laradD/locales/resources/LICENSES.chromium.html

    • Size

      6.3MB

    • MD5

      34999967f735b07e9cbcf6c397cea4db

    • SHA1

      8001fcdd6ce0c6e5a3d91fd45e4c9726fa67f3e4

    • SHA256

      c5a05048505c00af46c75fb5ca22057f09dce001eada3a756c3839d59011758f

    • SHA512

      b6c2f722b6551231801e453bba8f9593d9f1a82edb305869ee07ef77f286968eb6ad5db1abbe750e88c8af973c362ee161aa5c591ea04ff39e4f4b34e6fa4baf

    • SSDEEP

      24576:/PV05W5WS9YzHIlGMmfu626s6W6a6q5AHWeQFpD:F9n

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      S0laradD/locales/resources/app.asar.unpacked/node_modules/btime/binding.node

    • Size

      118KB

    • MD5

      13a2579ed95366185a6247c9e4b9f0cc

    • SHA1

      61fef12da622484e44b3c9ddcd61706c9af00aa0

    • SHA256

      98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f

    • SHA512

      7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0

    • SSDEEP

      1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t

    Score
    1/10
    behavioral10behavioral9

    • Target

      S0laradD/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node

    • Size

      125KB

    • MD5

      eeb1d1ea9fc3f870f292161cfa79850d

    • SHA1

      ea4f4324245f9f4d6280ef285151f688221d6023

    • SHA256

      149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c

    • SHA512

      795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254

    • SSDEEP

      3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG

    Score
    1/10
    behavioral11behavioral12

    • Target

      S0laradD/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node

    • Size

      118KB

    • MD5

      6c12c930f974e5bc7872b58964f42359

    • SHA1

      805c5c899c32535d2ee8b2bc12deefe5fdaae566

    • SHA256

      094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c

    • SHA512

      f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3

    • SSDEEP

      3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS

    Score
    1/10
    behavioral13behavioral14

    • Target

      S0laradD/locales/resources/d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      1e2f4329fa2e58be78f5fcde2aeea167

    • SHA1

      c2ecb4d0542c49d9e906d6173f77349aaa4749a6

    • SHA256

      a92f3bb1a4d846b38e8422d7c492f638e6bf47081facbb22c92568118938d5ce

    • SHA512

      8ae9b45f7427d83b5fd0afa49c920f79fc071f362dab0a4ef72be0fd19f5243779f071d762a66ffc2180121ded618e571470d3eabbdcf21b4125cf0b04ea62f3

    • SSDEEP

      49152:3uhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccG:ny904wYbZCoOI85oyIV

    Score
    1/10
    behavioral15

    • Target

      S0laradD/locales/resources/de.pak

    • Size

      367KB

    • MD5

      cfc9d90273c31ccf66d81739aa76306a

    • SHA1

      ecab570041654b147b3dd118829e2f7ae668f840

    • SHA256

      8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a

    • SHA512

      c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380

    • SSDEEP

      6144:F+QNkAjzYyqSFaPjON3Be0mzBWCj0Xs5HgIxBI0gql:cQLjMyvFaCN3mzBd5xy0gql

    Score
    3/10
    execution
    behavioral16behavioral17

    • Target

      S0laradD/locales/resources/ffmpeg.dll

    • Size

      2.6MB

    • MD5

      7f31b5234e44fac97d3c673a38c4c11f

    • SHA1

      65dc18e0bce308608dbba3c76d84e266c9fa53e6

    • SHA256

      0e751cd4312fab78d2c316860f1460875cd799e8d158f75934391c14ba328101

    • SHA512

      83658e0275a8e1fec8dd0f98c19c3e7d37a7205afc3547fdc09c60f0feebe72d30ecb2b182e9ed17ceaf3604ecd77810e330eff4cb5e38fef8a27b8ea9db2467

    • SSDEEP

      49152:zYuqVaqc35GHXVNtcZ44yODvSEbO/1o/GRRpYN4MJ8eIknusyUUjkU+jLtyTzQVN:zYLVl54yODvH/ySJUiLtyTzQVkU5qkJr

    Score
    1/10
    behavioral18behavioral19

    • Target

      S0laradD/locales/resources/mkl_mc3.1.dll

    • Size

      41.7MB

    • MD5

      4bb6c0f9c78d1932c913049123fbbce6

    • SHA1

      00727fe7c621f5221b43a4ef3dfd99586cb7b66d

    • SHA256

      1d8ef0630a35a3ad73e6b9b572519b5bafd10edc52427150856ca9ed19ac6329

    • SHA512

      dce1b95fafb9b710deeb5d5eae15e34926c173e7847c5429de460bbc63ba1397aed7fa3e6e318a6bdfe76012a713113882f32d0647fac0b7b59fe497b3275b1b

    • SSDEEP

      196608:scbXIQgR+1Hp+r09Hh1t0Nskcha7NOEFFumcTsJW6WGSNSOlXVAQfki6Nq26R5nO:qQg4xyFZkVAtq2ME7Z06

    Score
    1/10
    behavioral20behavioral21

    • Target

      S0laradD/locales/resources/vk_swiftshader.dll

    • Size

      4.8MB

    • MD5

      98cd947cb91f60c944b46c612ba732b1

    • SHA1

      6b4de1cd559ceeee8781c19e84a68a8759cff9d3

    • SHA256

      fdb59038b414deaaa96bf0744abd7a7d4fb36fd59bb2c3b36f71e5a2cc9c8d82

    • SHA512

      a262deb3683c93492bfb2467c539cdf8df5f684d49c4c78770ebfc62ae8a949f6b9a18497d377d62cd5231d0eca9994c6b5e7b0885ffed787bcff1ad41669999

    • SSDEEP

      49152:eveyoM/h2BPSjPJEvoSNxxJanAf9dX2kcngUkomWPG2pu6n9MT5F9AZCeqx7l1Zx:cQM/agZaHt7A4P//

    Score
    1/10
    behavioral22behavioral23

    • Target

      S0laradD/locales/resources/vulkan-1.dll

    • Size

      880KB

    • MD5

      0971bc5ea027dba6fb7e0e39713c9b64

    • SHA1

      fef070d731e910131ce4474e4b22b123749de3c7

    • SHA256

      c7d946d9585a856abe6201e2ddb128e6dd2a376950c375e5d09a4f1f0f0ad792

    • SHA512

      03e7bf839720b37a69b1e87779f552609a6df73913ecbb3a1baa8a814902ff563ba2a55eb95811a368d02cd93fa1d5a0d657ffbce9f8609474d4d7a6b6936db3

    • SSDEEP

      12288:mefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+4AEir1iSozbz:mOcTX8p20wsYHmXaATmXjvFozbz

    Score
    1/10
    behavioral24behavioral25

MITRE ATT&CK Enterprise v15

Tasks