Overview
overview
10Static
static
3Solara.zip
windows11-21h2-x64
1Password - github.txt
windows11-21h2-x64
3Solara/Deb...on.dll
windows11-21h2-x64
1Solara/Deb...er.ini
windows11-21h2-x64
3Solara/Deb...PF.tmp
windows11-21h2-x64
3Solara/Deb...PT.tmp
windows11-21h2-x64
3Solara/Deb...er.dll
windows11-21h2-x64
1Solara/Deb...nt.log
windows11-21h2-x64
3Solara/Deb...ce.dll
windows11-21h2-x64
1Solara/Debug/main.ini
windows11-21h2-x64
3Solara/Debug/ukm_db
windows11-21h2-x64
1Solara/Pac...in.xml
windows11-21h2-x64
1Solara/Pac...ce.dll
windows11-21h2-x64
1Solara/Pac...ls.xml
windows11-21h2-x64
1Solara/Solara.exe
windows11-21h2-x64
10Solara/acc...pl.dll
windows11-21h2-x64
1Solara/buf...ed.xml
windows11-21h2-x64
1Solara/buf...py.xml
windows11-21h2-x64
1Solara/buf...de.xml
windows11-21h2-x64
1Solara/buf...al.xml
windows11-21h2-x64
1Solara/buf...up.xml
windows11-21h2-x64
1Solara/buf...na.xml
windows11-21h2-x64
1Solara/oleprn.dll
windows11-21h2-x64
1Solara/wwancfg.dll
windows11-21h2-x64
1Analysis
-
max time kernel
439s -
max time network
441s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-08-2024 18:05
Static task
static1
Behavioral task
behavioral1
Sample
Solara.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Password - github.txt
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Solara/Debug/Addition.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Solara/Debug/Autoupdater.ini
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Solara/Debug/DebugPPF.tmp
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Solara/Debug/DebugPPT.tmp
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Solara/Debug/Helper.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
Solara/Debug/Management.log
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
Solara/Debug/Resource.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
Solara/Debug/main.ini
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
Solara/Debug/ukm_db
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Solara/Packaged/Main.xml
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
Solara/Packaged/Resource.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
Solara/Packaged/Utils.xml
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
Solara/Solara.exe
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
Solara/accessibilitycpl.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
Solara/buffed/chidedOcurred.xml
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
Solara/buffed/decineSatoriiCoppy.xml
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
Solara/buffed/ecocide.xml
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
Solara/buffed/gheddaOptimal.xml
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
Solara/buffed/pickup.xml
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
Solara/buffed/pictaviSina.xml
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
Solara/oleprn.dll
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
Solara/wwancfg.dll
Resource
win11-20240802-en
General
-
Target
Solara/buffed/pickup.xml
-
Size
4KB
-
MD5
a9f2f9f7d288d187c42f4897f8787889
-
SHA1
2a643f4e1a214d62b4965dd33481714838b3f2d1
-
SHA256
b482104f25fc6c5484d75e543a986eb8ace6104dfa809c8cad04726bbfb8f7a3
-
SHA512
5354f6538dba4181798bc16c3d42b793194e7a60ce2734672d0f9609b213b62f4665eb452be9f29a69baafd02e92bdc2cf213ff9fb1427f34a7f3033a6032588
-
SSDEEP
96:YTylIv7LQJc+DU9+UFKSp8gogh98f8YIVpmDAA4+sRlhQ8Iuk7:BlIDLQVDU9NF0wSDAjRo8IH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1378270501" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31128218" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3924 wrote to memory of 564 3924 MSOXMLED.EXE 81 PID 3924 wrote to memory of 564 3924 MSOXMLED.EXE 81
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Solara\buffed\pickup.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Solara\buffed\pickup.xml2⤵
- Modifies Internet Explorer settings
PID:564
-