Overview
overview
9Static
static
3So1araBoot...nf.zip
windows7-x64
1So1araBoot...nf.zip
windows10-2004-x64
1ReadMe.txt
windows7-x64
1ReadMe.txt
windows10-2004-x64
1So1ara.zip
windows7-x64
1So1ara.zip
windows10-2004-x64
1Solara/Sol...V2.exe
windows7-x64
7Solara/Sol...V2.exe
windows10-2004-x64
9Solara/Sol...st.lua
windows7-x64
3Solara/Sol...st.lua
windows10-2004-x64
3Solara/Sol...t2.lua
windows7-x64
3Solara/Sol...t2.lua
windows10-2004-x64
3Solara/Sol...le.txt
windows7-x64
1Solara/Sol...le.txt
windows10-2004-x64
1Solara/Sol...et.txt
windows7-x64
1Solara/Sol...et.txt
windows10-2004-x64
1Solara/Sol...le.txt
windows7-x64
1Solara/Sol...le.txt
windows10-2004-x64
1Solara/Sol..._1.txt
windows7-x64
1Solara/Sol..._1.txt
windows10-2004-x64
1Solara/Sol..._2.txt
windows7-x64
1Solara/Sol..._2.txt
windows10-2004-x64
1Solara/Sol...le.txt
windows7-x64
1Solara/Sol...le.txt
windows10-2004-x64
1Solara/Sol...le.txt
windows7-x64
1Solara/Sol...le.txt
windows10-2004-x64
1Solara/Sol...tefile
windows7-x64
1Solara/Sol...tefile
windows10-2004-x64
1Solara/Sol...le.txt
windows7-x64
1Solara/Sol...le.txt
windows10-2004-x64
1Solara/Sol...LL.txt
windows7-x64
1Solara/Sol...LL.txt
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 09:56 UTC
Static task
static1
Behavioral task
behavioral1
Sample
So1araBootstrappzxcvbnf.zip
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
So1araBootstrappzxcvbnf.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ReadMe.txt
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ReadMe.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
So1ara.zip
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
So1ara.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Solara/Solar/SolaraV2.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Solara/Solar/SolaraV2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Solara/Solar/autoexec/test.lua
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Solara/Solar/autoexec/test.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Solara/Solar/autoexec/test2.lua
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Solara/Solar/autoexec/test2.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Solara/Solar/workspace/.tests/appendfile.txt
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Solara/Solar/workspace/.tests/appendfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Solara/Solar/workspace/.tests/getcustomasset.txt
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Solara/Solar/workspace/.tests/getcustomasset.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Solara/Solar/workspace/.tests/isfile.txt
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
Solara/Solar/workspace/.tests/isfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Solara/Solar/workspace/.tests/listfiles/test_1.txt
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Solara/Solar/workspace/.tests/listfiles/test_1.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Solara/Solar/workspace/.tests/listfiles/test_2.txt
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Solara/Solar/workspace/.tests/listfiles/test_2.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Solara/Solar/workspace/.tests/loadfile.txt
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Solara/Solar/workspace/.tests/loadfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Solara/Solar/workspace/.tests/readfile.txt
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
Solara/Solar/workspace/.tests/readfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Solara/Solar/workspace/.tests/writefile
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Solara/Solar/workspace/.tests/writefile
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Solara/Solar/workspace/.tests/writefile.txt
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Solara/Solar/workspace/.tests/writefile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Solara/Solar/workspace/EzHubLL.txt
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Solara/Solar/workspace/EzHubLL.txt
Resource
win10v2004-20240802-en
General
-
Target
ReadMe.txt
-
Size
16B
-
MD5
ad359b7486d6870af461913236e0a094
-
SHA1
2ad213fd1efd12aa7e018a9df841a3c85f7dbd1a
-
SHA256
1e6bcf1474130be5357f8bc3cfe56010a2395663fbd0bfb1d4d4db15cc119889
-
SHA512
d3756be00941a77514defb962ccd0c949c310f141ab384bd81d0cd531b7d2039c0d8a775432da1fb92d8dedab7a373b4519af1ab0c89f90bb6a504af653335b0
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4544 NOTEPAD.EXE
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=20EAFEB22E8F6F6C2787EA602F346E05; domain=.bing.com; expires=Sat, 30-Aug-2025 09:57:33 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 54A613AEC866419CB296551F331993F2 Ref B: LON04EDGE0810 Ref C: 2024-08-05T09:57:33Z
date: Mon, 05 Aug 2024 09:57:33 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=20EAFEB22E8F6F6C2787EA602F346E05
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=08ckdQ67lFurZ5Dch_gIupaq21MnWRim3D8YlPfYHG4; domain=.bing.com; expires=Sat, 30-Aug-2025 09:57:33 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C25F72B169F749128310D5FBF7706312 Ref B: LON04EDGE0810 Ref C: 2024-08-05T09:57:33Z
date: Mon, 05 Aug 2024 09:57:33 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=20EAFEB22E8F6F6C2787EA602F346E05; MSPTC=08ckdQ67lFurZ5Dch_gIupaq21MnWRim3D8YlPfYHG4
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E5403236B79A414A84AB550E872464BC Ref B: LON04EDGE0810 Ref C: 2024-08-05T09:57:33Z
date: Mon, 05 Aug 2024 09:57:33 GMT
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request37.58.20.217.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request10.173.189.20.in-addr.arpaIN PTRResponse
-
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid=tls, http22.0kB 9.3kB 21 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee773863dbc14b909b5150e9b4fdf5b2&localId=w:46BA0F9A-9D8F-F2F0-D464-1297A0CDD8CE&deviceId=6825833576093963&anid=HTTP Response
204
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
71 B 131 B 1 1
DNS Request
37.58.20.217.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
10.173.189.20.in-addr.arpa