Overview

overview

9

Static

static

3

So1araBoot...nf.zip

windows7-x64

1

So1araBoot...nf.zip

windows10-2004-x64

1

ReadMe.txt

windows7-x64

1

ReadMe.txt

windows10-2004-x64

1

So1ara.zip

windows7-x64

1

So1ara.zip

windows10-2004-x64

1

Solara/Sol...V2.exe

windows7-x64

7

Solara/Sol...V2.exe

windows10-2004-x64

9

Solara/Sol...st.lua

windows7-x64

3

Solara/Sol...st.lua

windows10-2004-x64

3

Solara/Sol...t2.lua

windows7-x64

3

Solara/Sol...t2.lua

windows10-2004-x64

3

Solara/Sol...le.txt

windows7-x64

1

Solara/Sol...le.txt

windows10-2004-x64

1

Solara/Sol...et.txt

windows7-x64

1

Solara/Sol...et.txt

windows10-2004-x64

1

Solara/Sol...le.txt

windows7-x64

1

Solara/Sol...le.txt

windows10-2004-x64

1

Solara/Sol..._1.txt

windows7-x64

1

Solara/Sol..._1.txt

windows10-2004-x64

1

Solara/Sol..._2.txt

windows7-x64

1

Solara/Sol..._2.txt

windows10-2004-x64

1

Solara/Sol...le.txt

windows7-x64

1

Solara/Sol...le.txt

windows10-2004-x64

1

Solara/Sol...le.txt

windows7-x64

1

Solara/Sol...le.txt

windows10-2004-x64

1

Solara/Sol...tefile

windows7-x64

1

Solara/Sol...tefile

windows10-2004-x64

1

Solara/Sol...le.txt

windows7-x64

1

Solara/Sol...le.txt

windows10-2004-x64

1

Solara/Sol...LL.txt

windows7-x64

1

Solara/Sol...LL.txt

windows10-2004-x64

1

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 09:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Solara/Solar/workspace/EzHubLL.txt

  • Size

    2B

  • MD5

    99914b932bd37a50b983c5e7c90ae93b

  • SHA1

    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

  • SHA256

    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

  • SHA512

    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Solara\Solar\workspace\EzHubLL.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4716

Network

  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    140.32.126.40.in-addr.arpa

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.