rhadamanthys | hxxps://github[.]com/langyijun/Solara-Executor/raw/main/Roblox%20Injector[.]rar

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/langyijun/Solara-Executor/raw/main/Roblox%20Injector.rar

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://144.76.133.166:8034/5502b8a765a7d7349/k5851jfq.guti6

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

RegAsm.exe

description	pid	Process	procid_target
PID 4800 created 2832	4800	RegAsm.exe	50

Executes dropped EXE 4 IoCs

Processes:

Solara.exeSolara.exeSolara.exeSolara.exe

pid	Process
5980	Solara.exe
3020	Solara.exe
5248	Solara.exe
5380	Solara.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
16	raw.githubusercontent.com
15	raw.githubusercontent.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

Solara.exeSolara.exeSolara.exeSolara.exe

description	pid	Process	procid_target
PID 5980 set thread context of 4800	5980	Solara.exe	141
PID 3020 set thread context of 2884	3020	Solara.exe	151
PID 5248 set thread context of 5096	5248	Solara.exe	158
PID 5380 set thread context of 5024	5380	Solara.exe	160

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
3536	4800	WerFault.exe	141
2492	4800	WerFault.exe	141
5992	2884	WerFault.exe	151
224	2884	WerFault.exe	151
5260	5096	WerFault.exe	158
5476	5096	WerFault.exe	158
2236	5024	WerFault.exe	160
1488	5024	WerFault.exe	160

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RegAsm.exeopenwith.exeSolara.exeSolara.exeSolara.exeRegAsm.exeSolara.exeRegAsm.exeRegAsm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeRegAsm.exeopenwith.exe

pid	Process
2912	msedge.exe
2912	msedge.exe
3476	msedge.exe
3476	msedge.exe
2724	identity_helper.exe
2724	identity_helper.exe
3484	msedge.exe
3484	msedge.exe
2456	msedge.exe
2456	msedge.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
4800	RegAsm.exe
4800	RegAsm.exe
684	openwith.exe
684	openwith.exe
684	openwith.exe
684	openwith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

7zG.exe7zG.exe

description	pid	Process
Token: SeRestorePrivilege	5788	7zG.exe
Token: 35	5788	7zG.exe
Token: SeSecurityPrivilege	5788	7zG.exe
Token: SeSecurityPrivilege	5788	7zG.exe
Token: SeRestorePrivilege	3040	7zG.exe
Token: 35	3040	7zG.exe
Token: SeSecurityPrivilege	3040	7zG.exe
Token: SeSecurityPrivilege	3040	7zG.exe

Suspicious use of FindShellTrayWindow 50 IoCs

Processes:

msedge.exe7zG.exe7zG.exe

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
5788	7zG.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3040	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 3476 wrote to memory of 3516	3476	msedge.exe	86
PID 3476 wrote to memory of 3516	3476	msedge.exe	86
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 1540	3476	msedge.exe	87
PID 3476 wrote to memory of 2912	3476	msedge.exe	88
PID 3476 wrote to memory of 2912	3476	msedge.exe	88
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89
PID 3476 wrote to memory of 3992	3476	msedge.exe	89

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2832
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/langyijun/Solara-Executor/raw/main/Roblox%20Injector.rar
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe664d46f8,0x7ffe664d4708,0x7ffe664d4718
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,138415661943626246,2938583947663766532,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5676

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Roblox Injector\" -ad -an -ai#7zMap32269:92:7zEvent23001
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5788

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Roblox Injector\Link.txt
1⤵
PID:5916

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Roblox Injector\Link.txt
1⤵
PID:1964

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Solara\" -ad -an -ai#7zMap32738:74:7zEvent22044
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3040

C:\Users\Admin\Downloads\Solara\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara\Solara\Solara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 572
    3⤵
    - Program crash
    PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 600
    3⤵
    - Program crash
    PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4800 -ip 4800
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4800 -ip 4800
1⤵
PID:3372

C:\Users\Admin\Downloads\Solara\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara\Solara\Solara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 572
    3⤵
    - Program crash
    PID:5992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 596
    3⤵
    - Program crash
    PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2884 -ip 2884
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2884 -ip 2884
1⤵
PID:2284

C:\Users\Admin\Downloads\Solara\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara\Solara\Solara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 572
    3⤵
    - Program crash
    PID:5260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 580
    3⤵
    - Program crash
    PID:5476

C:\Users\Admin\Downloads\Solara\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara\Solara\Solara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 572
    3⤵
    - Program crash
    PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 568
    3⤵
    - Program crash
    PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5096 -ip 5096
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5096 -ip 5096
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5024 -ip 5024
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5024 -ip 5024
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Solara.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59583ae8-abca-474d-b0c6-19a4b7988fa9.tmp

Filesize
261B

MD5
95dc4f8e2128a3ce9be68a907e394618

SHA1
a41e1e7f4dc5f12914843eff3c18f34af8dbfede

SHA256
ed4207cb7ac42d7de811b89d55a54dfe09bdd7482430d0f49925014db194ea73

SHA512
14fe0289dcdb17b8f6cad6a763431e1945272fe6ebdc9c455f55113a4f2b8176fd37815fe16796644c25c7386d699d24c8b5fa2cba2b327944cbc29ecd872182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9033c40bbd01b732c535675e0bed2d70

SHA1
6ad6a4766310152b92432fb6dd314b188b4d9c7c

SHA256
80e664413238b09f7273f56d79f6960cf8bb88dc5dfcf9fa8e48fdec639bbfda

SHA512
49daec22581c40a5ce7edf859ae823005a4e1fb9b2075065190167f00ebf849f76750eb7f24d081989296854d5c4c9cd28550c3aeffbbd98109a78613ea8867d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
298921cacacc6cac5d0abf1a0830e44c

SHA1
975d80fa6e35ba837e1b427370ffdc28de4ebffc

SHA256
22ac129ac49e03cbbcb47807dcfe414132675718dd2719ff9ef85c710d364363

SHA512
487615fc03395fc1ff1d0233a25968235feb6768f0b61b4dbfe33716e709f4212d25ac1f6341c8f591750cb7800bd04219ca2a17adcf78513aa8caf2ff7b464d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
190ba5ed371bd8040fe677fe04f0b1f5

SHA1
9360a994d0d5379e579453a5f3431f1ea73e7e9d

SHA256
06146101a27546e0ba14553722036a2360f1ca3d3cac70abfc5b6d96b8b75d12

SHA512
4555958ee18caae3f4006a5c00a46af8c902fc372e95368899fc01080faae013b9c01ab41ada753b079160a0549cdad3d9d9f70b4b2e4fe95e785dd95e6272b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9e4737830b3f6949348b81603bfa5e40

SHA1
df393a7344420a8d4cb3f49ea42991009f06a879

SHA256
d2e59aeac8dca615c7924eaee6b56fa8a6a994d50239375525b8fc0f60c1cd82

SHA512
75f52bc8fd137fde3e9743a92df78116600b7a9b8b95f77f42d4a6f086646f68f234390ee47639c8256fd77b03c58d6f78147227dcbbbda06aea8e45fdf60614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586f30.TMP

Filesize
371B

MD5
959f747dfbb14304e6f3ea7a6ffbde3c

SHA1
c67238d3641b6cd458a219b351907597b84f0595

SHA256
1771c174cf011d3c93ac089b4d100dc930fc4a86b139617dbe6f9b7762095efe

SHA512
bfeca5b2d5fb479644bc491df193e42d2c662cf363c3204ee29c5c1326507526571abc58853ca96b82c6cf6d108d9a6b7e986472b001eb68d5b104f7baeeec3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
536517aa54eaafafb6a4f73a6e842fc2

SHA1
43706e6e96716cdd3cf450a22e82382d8e495add

SHA256
3cfaf1144abd6e07f71ba5482726896aab9531091cb40e1d5395c0ab67181af0

SHA512
7d0ea7c2abfcaf34efb84528eac69d452d1d6f8734259836ef8bcbd61b83c1d4b02a8567a4c0541ffb87693a69e3fd69c69bd17aee66308dbd35b368c5ee04a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a2254eacdb7c3ad1cd37c6996937b012

SHA1
94d9123a9b034c27d33739ef1c47eea8271aba07

SHA256
2c28399299879c858f66c97db1c70b032e00aeb918121771d42a0c61a1503594

SHA512
c07e6eef1c3462dc84208b184bb8aab911caa51f0160293d8b933e17642442ba090ac22fa76fdc655d2af82dd9fb065aef69e0f0fb4f46b629dcd2eb5f211060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d38b1d886d74641299d69a1ac42d9064

SHA1
27dafda4af27d3b25003f7c39d5ac07298359930

SHA256
ce05c9adffaa15d75f1b6a57c737d32e8f03dbeb6675dbe19bc2a0ebcf66b511

SHA512
e618de548d8b843246b61387a757dd70c7358e19182e09d2620a18b5528c7d1d5a75af2740cc09979e76f71c57c6f43f05fc7ec780a102edec2d6c74ea09db92

Download Submit
C:\Users\Admin\Downloads\Roblox Injector.rar

Filesize
169B

MD5
40c9252229a6a6a4b751209e30b76076

SHA1
4e5dafc543d60c30a538717876310f724784aeea

SHA256
f6834a14e090be8c59d68deb799159c76f54b8a9a869645558d3d2688312e1f2

SHA512
f197f57fdf46b7f18f7deb9045d1350b7b5d0428395e359bc9ddbca442dc1eeda76bae24b6250f1e568cd10a206ea88c11c914332dad7e1018716ba314d8070b

Download Submit
C:\Users\Admin\Downloads\Roblox Injector\Link.txt

Filesize
97B

MD5
0c6ffdecc4ddedb8e8763a78ba8028b7

SHA1
cb3d9f466115bc753b0b3496e7eb2a8c0c86476e

SHA256
5c9e5f800e71618a6f083e8747854b03d330a5bcbc1f54bf846910f0ea620c82

SHA512
765cf638003b71dbc959a53bd86b360a3add1d9a0ab1400318656fc96d33e70ad10f9f95c0a81d112567e5d98449f323e33784a25f54fbe3471e3cfe29377a80

Download Submit
C:\Users\Admin\Downloads\Solara\Solara\Solara.exe

Filesize
443KB

MD5
ca3a48c58e2e078037d6fe0432565caa

SHA1
665d5d7c26f6e37287f0ca16a72804a01e8b7169

SHA256
9bbe90d9cfa9e088d0a2c31bd1b8f93c2a9bb8a792ff99ec4bbc7ca1c44491c2

SHA512
bd95c53c7340e00f72b6b361cffa8a87d4fe2d2b2f398378862144498acb8a18d39813d8f9113ee632b55c8fbeaf549b384336a8fae7b26eeb848db9e6853e95

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 791911.crdownload

Filesize
11.4MB

MD5
a3352765d4861f4778fb48f88af55060

SHA1
bf6a6c1d96c2d5ca3c8e07178436677d5bb6fcc6

SHA256
6bb3f456eb19ad3de115967330ebd6b6624ff44b5c48d12cb934b1ffae594e7b

SHA512
a2e6b4438934fab7d839d489e94f3698f5111388693efcfed002b3e0d8059fa8d8d6156d91cdf92e69a0fead56f45955f9c73f75704ae73afdeb862031342d97

Download Submit
\??\pipe\LOCAL\crashpad_3476_MQNLZFIFRFPFXTDR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/684-225-0x00007FFE75030000-0x00007FFE75225000-memory.dmp

Filesize
2.0MB

Download
memory/684-222-0x0000000000E00000-0x0000000000E09000-memory.dmp

Filesize
36KB

Download
memory/684-227-0x0000000075BB0000-0x0000000075DC5000-memory.dmp

Filesize
2.1MB

Download
memory/684-224-0x0000000002A40000-0x0000000002E40000-memory.dmp

Filesize
4.0MB

Download
memory/2884-245-0x0000000003770000-0x0000000003B70000-memory.dmp

Filesize
4.0MB

Download
memory/2884-232-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2884-234-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4800-219-0x00007FFE75030000-0x00007FFE75225000-memory.dmp

Filesize
2.0MB

Download
memory/4800-221-0x0000000075BB0000-0x0000000075DC5000-memory.dmp

Filesize
2.1MB

Download
memory/4800-212-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4800-218-0x0000000003B50000-0x0000000003F50000-memory.dmp

Filesize
4.0MB

Download
memory/4800-217-0x0000000003B50000-0x0000000003F50000-memory.dmp

Filesize
4.0MB

Download
memory/4800-216-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4800-214-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5024-257-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5024-261-0x00000000036F0000-0x0000000003AF0000-memory.dmp

Filesize
4.0MB

Download
memory/5024-255-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5096-251-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5096-249-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5096-259-0x0000000003D20000-0x0000000004120000-memory.dmp

Filesize
4.0MB

Download
memory/5980-210-0x0000000000B70000-0x0000000000BE2000-memory.dmp

Filesize
456KB

Download