rhadamanthys | hxxps://github[.]com/Clodio23/Solara-Executor

Analysis

max time kernel
203s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Clodio23/Solara-Executor

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://144.76.133.166:8034/5502b8a765a7d7349/k5851jfq.guti6

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Solara.exe

description	pid	Process	procid_target
PID 5468 created 2852	5468	Solara.exe	49

Executes dropped EXE 2 IoCs

Processes:

Solara.exeSolara.exe

pid	Process
5556	Solara.exe
5528	Solara.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
34	camo.githubusercontent.com
36	camo.githubusercontent.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

Solara.exeSolara.exeSolara.exe

description	pid	Process	procid_target
PID 3044 set thread context of 5468	3044	Solara.exe	123
PID 6088 set thread context of 3648	6088	Solara.exe	138
PID 5556 set thread context of 5528	5556	Solara.exe	148

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
5668	5468	WerFault.exe	123
5528	5468	WerFault.exe	123
4312	3648	WerFault.exe	138
5128	3648	WerFault.exe	138
3012	5528	WerFault.exe	148
5796	5528	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Solara.exeSolara.exeSolara.exeSolara.exeSolara.exeopenwith.exeSolara.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeSolara.exeSolara.exeopenwith.exemsedge.exe

pid	Process
2304	msedge.exe
2304	msedge.exe
4524	msedge.exe
4524	msedge.exe
3316	identity_helper.exe
3316	identity_helper.exe
5744	msedge.exe
5744	msedge.exe
3044	Solara.exe
3044	Solara.exe
5468	Solara.exe
5468	Solara.exe
452	openwith.exe
452	openwith.exe
452	openwith.exe
452	openwith.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Solara.exe7zG.exe

description	pid	Process
Token: SeDebugPrivilege	3044	Solara.exe
Token: SeRestorePrivilege	2280	7zG.exe
Token: 35	2280	7zG.exe
Token: SeSecurityPrivilege	2280	7zG.exe
Token: SeSecurityPrivilege	2280	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4524 wrote to memory of 1576	4524	msedge.exe	87
PID 4524 wrote to memory of 1576	4524	msedge.exe	87
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 4676	4524	msedge.exe	88
PID 4524 wrote to memory of 2304	4524	msedge.exe	89
PID 4524 wrote to memory of 2304	4524	msedge.exe	89
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90
PID 4524 wrote to memory of 4824	4524	msedge.exe	90

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2852
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Clodio23/Solara-Executor
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc538f46f8,0x7ffc538f4708,0x7ffc538f4718
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16525852562005243157,11238545596773256953,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5908

C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
- C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe"
  2⤵
  PID:5460
- C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 476
    3⤵
    - Program crash
    PID:5668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 472
    3⤵
    - Program crash
    PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5468 -ip 5468
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5468 -ip 5468
1⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6088
- C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Solara.zip\Solara\Solara.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 412
    3⤵
    - Program crash
    PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 420
    3⤵
    - Program crash
    PID:5128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3648 -ip 3648
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3648 -ip 3648
1⤵
PID:320

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Solara\" -ad -an -ai#7zMap12970:74:7zEvent32532
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Users\Admin\Downloads\Solara\Solara\Solara.exe
"C:\Users\Admin\Downloads\Solara\Solara\Solara.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5556
- C:\Users\Admin\Downloads\Solara\Solara\Solara.exe
  "C:\Users\Admin\Downloads\Solara\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 228
    3⤵
    - Program crash
    PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 464
    3⤵
    - Program crash
    PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5528 -ip 5528
1⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5528 -ip 5528
1⤵
PID:5824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Solara.exe.log

Filesize
617B

MD5
99e770c0d4043aa84ef3d3cbc7723c25

SHA1
19829c5c413fccba750a3357f938dfa94486acad

SHA256
33c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5

SHA512
ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fac9de39443354a670da25957d2111d7

SHA1
e766ad481cbc832ef59d0da8b30f5922dc461db8

SHA256
14aede07665beb2d82375e43eab711f84fc54a09b32fb104d3bcb556f99edbfd

SHA512
0806bfe3008e688206bf3bdfeab7a83a9ace146da47319977ab2f2b2ade6c3849bc138d393a821ca68e2ab96d540200037ac818ca91cb9726d8da6cd5383e357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
679B

MD5
fb8acf42c95956b3ea7a359568e78e18

SHA1
acfdf238aee14b52f5c682978a7c2a159d0d19c8

SHA256
3d159de646f17fdf8d11616e36908d64dff1f51897147a482676c5878b8591aa

SHA512
a0467617dae4d9d5bfd1bcbd1efe5f812cea49f4fd0f4d90eaf5b41ae14c01f8653a2051e87dccbeea04f6efbd54fcdc3ea6661c62ef8127f3fadfa777ffc47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a7960d23f025d861cf95ce812c58106

SHA1
c07e4af4a57d1ab65dc6eab87fb7bd6c1a5ccc52

SHA256
dbab90ac87c3838fc32ad1619237af16b79bad69f35b0b2a8ecbea53082e654e

SHA512
8a89dcd04271a1f6d98d26ad142f007ff810eb59b4ea17071d44d5b4a80ef3b11c3f0b9188911be1ffc68f5a37e79d0a969b3b87750eb9a30b07fe301f446711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a444dcb39967af8baa96f2f21c45150

SHA1
7bb2ed0ab15ad34f1f42f86d557a6631d9dd9605

SHA256
e2c684eefc910212ca225775ea7020af8459697b21b111201422321c08a452d5

SHA512
c61ec6902c2d6f1fc075637ec742f253b1b6e62c6e7159bb7f77f6c2aa10e0f80c26e01b8854f0e8eb3162acae8c894ee20049897ff69c9cc00150f151b1bbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6674e0e34a1ed5693a137c49c0691711

SHA1
7e831d4a847038186cc7ff206a42c889078bf83c

SHA256
4394ab88008210657dc2f280332f5b71657d7b4515e0322debd692cfbb479354

SHA512
cfee5f8257d6c106b377e268ca65c3d86285edc5d3f9745e502c844c2a0937d90ec0caa95446edabde432fa3844bb1a7668be2071c4b469cf1ac165b2794e3c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
049aa759b58a1707f481acc125da5505

SHA1
a7b263ea17df03926c2f906936ac9394078d585a

SHA256
161bb5678b66d383c45d5be999ea407ed192a05e3fa74089ff105d130ce7feb8

SHA512
aa2f858987304f41a0ac01f9d2bcb927b61e81fdd36efb0045de3d10ff28595c788fc7327af12e5ed200d7652e1e70d19744ba042a7c06dd4d224237a3efa8d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58292e.TMP

Filesize
1KB

MD5
c3b3bdbdfc8f3743ea257891f19a012c

SHA1
6239eb03270ec6ae54c33bd5059a00b20bd7e347

SHA256
3f9deebb63e161dc47d92c73e13f1ccf86877d818d1b67d575251b22e6ad6f28

SHA512
0eaff9a87ac14bb9985e8166d64e2a2ed2440e27d931034bf2bb8a2955fa8b85512b3fc7045de840b39c8af6cb79ce245c936e94e90a42b82df8cb7814265ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84fa19ba09f69656fa039434676472fa

SHA1
6bd5c48cdd8ae68259a2214c1c38f3fd5899ed59

SHA256
bca5f386bae2176ebe47a24ea9189160866d8d595dccc47231aab128f748449d

SHA512
2634141f8513b0df6662881aea6ae493edcaa5e0a67030149a1e620e9c1dfc0162ed1f7ab7d65a954b542579a48653a46c38c9581fd7c094e9a6d30d8b297ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
016aae427d10f4bacda9c549d55ef63f

SHA1
b7f18ac31e3d8b890beb2316f19fab5120eb27d0

SHA256
572006e8fa619397d0aac7a0c39a86682981027c469ca88dc0ac569a22cbaf7b

SHA512
c2107774bd5c3d93f2f97fc34ba1d545c27b325da8527c348a0e6f36d7e3a1ed92779529a65698a02538750150db1e4b24a61e3f86fb40e046ff416aaed5428d

Download Submit
C:\Users\Admin\Downloads\Solara\Solara\Solara.exe

Filesize
6.2MB

MD5
da26c67d857555aeef4f2580e53d7c6d

SHA1
fc39f8e1987aa7d8553b052b789a7e6b0d24a68a

SHA256
b9536929d0de9b4a18e7646f2ecf59aad20f93092e982be91d20143d599e6c22

SHA512
115ff4890967b3a00bf2e192d9e2d8717bc7525bab995ca5db7c5c7d2be6a81888ae9687f51d04d053371088e553381a7844a82433240022bccbc44b319df75d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 130821.crdownload

Filesize
14.9MB

MD5
456adec7a01fff85c1204428b5123a66

SHA1
26165fe003a01a3a59dc64070fbf2e96187214d7

SHA256
b6127458de06667662655e158e7d1adc6cf505d08d9dffe243a0b308b3166090

SHA512
3b2cbfaf171297da578c0db840e54a156a1aec481a0f441acaddfe127d20f1013d62a74c99fdbb8a44bc9ced109aa25509dad05131cc5cfe99ade170027fcc41

Download Submit
\??\pipe\LOCAL\crashpad_4524_FGGZDJXUOWCMRHXA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/452-317-0x0000000002430000-0x0000000002830000-memory.dmp

Filesize
4.0MB

Download
memory/452-315-0x0000000000580000-0x0000000000589000-memory.dmp

Filesize
36KB

Download
memory/452-320-0x0000000076530000-0x0000000076745000-memory.dmp

Filesize
2.1MB

Download
memory/452-318-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-303-0x0000000005EE0000-0x0000000005F7C000-memory.dmp

Filesize
624KB

Download
memory/3044-306-0x0000000005D70000-0x0000000005D92000-memory.dmp

Filesize
136KB

Download
memory/3044-302-0x0000000000E00000-0x000000000142A000-memory.dmp

Filesize
6.2MB

Download
memory/3044-305-0x0000000006800000-0x0000000006DA4000-memory.dmp

Filesize
5.6MB

Download
memory/3044-304-0x0000000006070000-0x0000000006252000-memory.dmp

Filesize
1.9MB

Download
memory/3648-328-0x0000000004420000-0x0000000004820000-memory.dmp

Filesize
4.0MB

Download
memory/3648-324-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5468-307-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5468-310-0x0000000003EB0000-0x00000000042B0000-memory.dmp

Filesize
4.0MB

Download
memory/5468-309-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5468-314-0x0000000076530000-0x0000000076745000-memory.dmp

Filesize
2.1MB

Download
memory/5468-312-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/5468-311-0x0000000003EB0000-0x00000000042B0000-memory.dmp

Filesize
4.0MB

Download
memory/5528-391-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5528-393-0x00000000040D0000-0x00000000044D0000-memory.dmp

Filesize
4.0MB

Download
memory/6088-322-0x0000000005DE0000-0x0000000005E02000-memory.dmp

Filesize
136KB

Download