Resubmissions
19-08-2024 08:20
240819-j8h5hstblh 1019-08-2024 08:18
240819-j7arrawgqm 1019-08-2024 08:16
240819-j594tstamb 10Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 08:18
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win10v2004-20240802-en
General
-
Target
Solara.exe
-
Size
81.2MB
-
MD5
10d3cf93e2763c12e2cb1861157bd11c
-
SHA1
3a2995e034de83a7a2007809d62898ff361135f8
-
SHA256
9edec2d7604cd19e991c680524d372e23b6a56452b2c93b7a9ef45bbedaf47c6
-
SHA512
c2ef4c4f63f5f47201daa7f9db8923e125297a86bbf93e8f355587a8c8febca60e689bb483de496441cc1d0ac6e65067c9eae696d6e575b4b32e21915e6ca5d4
-
SSDEEP
1572864:YvxZQglPWjg7vaSk8IpG7V+VPhqHDE7jblgA7iYgj+h58sMw2IrD2:YvxZx9heSkB05awHaeA151
Malware Config
Signatures
-
Enumerates VirtualBox DLL files 2 TTPs 2 IoCs
Processes:
Solara.exedescription ioc Process File opened (read-only) C:\windows\system32\vboxhook.dll Solara.exe File opened (read-only) C:\windows\system32\vboxmrxnp.dll Solara.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE 1 IoCs
Processes:
Solara.exepid Process 3320 Solara.exe -
Loads dropped DLL 64 IoCs
Processes:
Solara.exepid Process 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe -
Processes:
resource yara_rule behavioral1/files/0x0007000000023906-1312.dat upx behavioral1/memory/1424-1316-0x00007FFAA3D00000-0x00007FFAA42E8000-memory.dmp upx behavioral1/files/0x0007000000023499-1323.dat upx behavioral1/memory/1424-1329-0x00007FFAADDC0000-0x00007FFAADDE4000-memory.dmp upx behavioral1/files/0x00070000000238b2-1330.dat upx behavioral1/files/0x0007000000023497-1341.dat upx behavioral1/files/0x000700000002349d-1346.dat upx behavioral1/memory/1424-1347-0x00007FFAB1B90000-0x00007FFAB1BBD000-memory.dmp upx behavioral1/memory/1424-1345-0x00007FFAB1BC0000-0x00007FFAB1BD9000-memory.dmp upx behavioral1/memory/1424-1342-0x00007FFABC300000-0x00007FFABC30F000-memory.dmp upx behavioral1/memory/1424-1389-0x00007FFAB1B70000-0x00007FFAB1B84000-memory.dmp upx behavioral1/memory/1424-1390-0x00007FFAA3360000-0x00007FFAA36D5000-memory.dmp upx behavioral1/memory/1424-1392-0x00007FFABC2F0000-0x00007FFABC2FD000-memory.dmp upx behavioral1/memory/1424-1395-0x00007FFAB1B20000-0x00007FFAB1B4E000-memory.dmp upx behavioral1/memory/1424-1394-0x00007FFAA4F00000-0x00007FFAA4FB8000-memory.dmp upx behavioral1/memory/1424-1396-0x00007FFAB6DA0000-0x00007FFAB6DAD000-memory.dmp upx behavioral1/memory/1424-1399-0x00007FFAA4ED0000-0x00007FFAA4EF6000-memory.dmp upx behavioral1/memory/1424-1400-0x00007FFAA3240000-0x00007FFAA335C000-memory.dmp upx behavioral1/memory/1424-1398-0x00007FFAB67F0000-0x00007FFAB67FB000-memory.dmp upx behavioral1/memory/1424-1397-0x00007FFAADDC0000-0x00007FFAADDE4000-memory.dmp upx behavioral1/memory/1424-1393-0x00007FFAA3D00000-0x00007FFAA42E8000-memory.dmp upx behavioral1/memory/1424-1391-0x00007FFAB1B50000-0x00007FFAB1B69000-memory.dmp upx behavioral1/memory/1424-1402-0x00007FFAA4E90000-0x00007FFAA4EC6000-memory.dmp upx behavioral1/memory/1424-1419-0x00007FFAA4E60000-0x00007FFAA4E6B000-memory.dmp upx behavioral1/memory/1424-1420-0x00007FFAA4E50000-0x00007FFAA4E5C000-memory.dmp upx behavioral1/memory/1424-1418-0x00007FFAA4E70000-0x00007FFAA4E7B000-memory.dmp upx behavioral1/memory/1424-1417-0x00007FFAB1B20000-0x00007FFAB1B4E000-memory.dmp upx behavioral1/memory/1424-1416-0x00007FFAA4F00000-0x00007FFAA4FB8000-memory.dmp upx behavioral1/memory/1424-1415-0x00007FFAA4E80000-0x00007FFAA4E8C000-memory.dmp upx behavioral1/memory/1424-1414-0x00007FFAB1B50000-0x00007FFAB1B69000-memory.dmp upx behavioral1/memory/1424-1413-0x00007FFAAF170000-0x00007FFAAF17B000-memory.dmp upx behavioral1/memory/1424-1412-0x00007FFAA85A0000-0x00007FFAA85AE000-memory.dmp upx behavioral1/memory/1424-1411-0x00007FFAAD710000-0x00007FFAAD71C000-memory.dmp upx behavioral1/memory/1424-1421-0x00007FFAA3240000-0x00007FFAA335C000-memory.dmp upx behavioral1/memory/1424-1429-0x00007FFAA4E90000-0x00007FFAA4EC6000-memory.dmp upx behavioral1/memory/1424-1430-0x00007FFAA4400000-0x00007FFAA4414000-memory.dmp upx behavioral1/memory/1424-1431-0x00007FFAA3210000-0x00007FFAA3232000-memory.dmp upx behavioral1/memory/1424-1428-0x00007FFAA4420000-0x00007FFAA4432000-memory.dmp upx behavioral1/memory/1424-1427-0x00007FFAA4DE0000-0x00007FFAA4DF5000-memory.dmp upx behavioral1/memory/1424-1426-0x00007FFAA4ED0000-0x00007FFAA4EF6000-memory.dmp upx behavioral1/memory/1424-1425-0x00007FFAA4E00000-0x00007FFAA4E0C000-memory.dmp upx behavioral1/memory/1424-1424-0x00007FFAA4E10000-0x00007FFAA4E22000-memory.dmp upx behavioral1/memory/1424-1423-0x00007FFAA4E30000-0x00007FFAA4E3D000-memory.dmp upx behavioral1/memory/1424-1422-0x00007FFAA4E40000-0x00007FFAA4E4C000-memory.dmp upx behavioral1/memory/1424-1410-0x00007FFAAF160000-0x00007FFAAF16C000-memory.dmp upx behavioral1/memory/1424-1409-0x00007FFAA3360000-0x00007FFAA36D5000-memory.dmp upx behavioral1/memory/1424-1408-0x00007FFAAFFA0000-0x00007FFAAFFAC000-memory.dmp upx behavioral1/memory/1424-1407-0x00007FFAB1A50000-0x00007FFAB1A5B000-memory.dmp upx behavioral1/memory/1424-1406-0x00007FFAB3310000-0x00007FFAB331C000-memory.dmp upx behavioral1/memory/1424-1405-0x00007FFAB5EF0000-0x00007FFAB5EFB000-memory.dmp upx behavioral1/memory/1424-1404-0x00007FFAB6010000-0x00007FFAB601B000-memory.dmp upx behavioral1/memory/1424-1403-0x00007FFAB1B70000-0x00007FFAB1B84000-memory.dmp upx behavioral1/memory/1424-1401-0x00007FFAB1B90000-0x00007FFAB1BBD000-memory.dmp upx behavioral1/memory/1424-1432-0x00007FFAA31F0000-0x00007FFAA3207000-memory.dmp upx behavioral1/memory/1424-1433-0x00007FFAA3180000-0x00007FFAA3199000-memory.dmp upx behavioral1/memory/1424-1434-0x00007FFAA3130000-0x00007FFAA317D000-memory.dmp upx behavioral1/memory/1424-1436-0x00007FFAA3110000-0x00007FFAA3121000-memory.dmp upx behavioral1/memory/1424-1435-0x00007FFAA4E50000-0x00007FFAA4E5C000-memory.dmp upx behavioral1/memory/1424-1437-0x00007FFAA4DD0000-0x00007FFAA4DDA000-memory.dmp upx behavioral1/memory/1424-1438-0x00007FFAA30F0000-0x00007FFAA310E000-memory.dmp upx behavioral1/memory/1424-1439-0x00007FFAA3090000-0x00007FFAA30ED000-memory.dmp upx behavioral1/memory/1424-1440-0x00007FFAA2F80000-0x00007FFAA2FA9000-memory.dmp upx behavioral1/memory/1424-1444-0x00007FFAA3210000-0x00007FFAA3232000-memory.dmp upx behavioral1/memory/1424-1443-0x00007FFAA2B60000-0x00007FFAA2CD3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Solara.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solara.exe = "C:\\Users\\Admin\\Solara.exe\\Solara.exe" Solara.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exemsedge.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 3720 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133685291586955364" chrome.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exeSolara.exepowershell.exemsedge.exemsedge.exeidentity_helper.exepid Process 4592 chrome.exe 4592 chrome.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 1424 Solara.exe 4660 powershell.exe 4660 powershell.exe 4660 powershell.exe 1088 msedge.exe 1088 msedge.exe 776 msedge.exe 776 msedge.exe 776 msedge.exe 5816 identity_helper.exe 5816 identity_helper.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid Process 4