rhadamanthys | hxxps://github[.]com/Clodio23/Solara-Executor

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Clodio23/Solara-Executor

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://144.76.133.166:8034/5502b8a765a7d7349/k5851jfq.guti6

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3928 created 2468	3928	Solara.exe	42

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	camo.githubusercontent.com
36	camo.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 3928	5068	Solara.exe	123

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4856	3928	WerFault.exe	123
3284	3928	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
840	msedge.exe
840	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
4212	msedge.exe
4212	msedge.exe
3928	Solara.exe
3928	Solara.exe
4712	openwith.exe
4712	openwith.exe
4712	openwith.exe
4712	openwith.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	taskmgr.exe
Token: SeSystemProfilePrivilege	4648	taskmgr.exe
Token: SeCreateGlobalPrivilege	4648	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 468	840	msedge.exe	83
PID 840 wrote to memory of 468	840	msedge.exe	83
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 1464	840	msedge.exe	85
PID 840 wrote to memory of 1464	840	msedge.exe	85
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2468
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Clodio23/Solara-Executor
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbdec46f8,0x7ffdbdec4708,0x7ffdbdec4718
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3000

C:\Users\Admin\Desktop\Solara\Solara.exe
"C:\Users\Admin\Desktop\Solara\Solara.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5068
- C:\Users\Admin\Desktop\Solara\Solara.exe
  "C:\Users\Admin\Desktop\Solara\Solara.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 496
    3⤵
    - Program crash
    PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 504
    3⤵
    - Program crash
    PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3928 -ip 3928
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3928 -ip 3928
1⤵
PID:3240

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bee17175e812d89c0348f806e9734bb4

SHA1
7dbc9dd0a70ff41c1592c07afb25ca2ca8d57bf2

SHA256
6d5893262a38e52dd56b9d1486a70f6e21a167d3638ad4814548cbcc8bfff9f8

SHA512
128bf82d4f5e312b6c6fa64e2040826ab142fee5ea1f605a4b6627f825bef53e09a8fd2bdb9b1929b73c02cd755d6d489dcfd59542f162a79efe2b1601fb5acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
679B

MD5
6e0c732ea8c1954b30a4ced82247e4c4

SHA1
b44b6a0d4021cf33dccd4e861b5ffae563b83385

SHA256
889f30c8ed2501a80f17df85b7810d81f504fb9cde82c48da11d75b8d54537f8

SHA512
893bd4547c75efa94d99f765a0e50186baed283412fb3fe81270d4f1c46b9c8ba33572a98f662585a3de67d1cd368cba0dd7835b27aa10159aa2f3985de83ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ddaf949fd49a3049fea0b19ccff5c9df

SHA1
c42358a15acd81aa0c798fb921a68b29f3d4918d

SHA256
6d7e6f6946a40a5202a83ad2eac3bb5dd3d9c50c486ab349a66fff3f68dc2760

SHA512
d9e6dc72c4b173f926e7048aa092dcf11311ec12b612cefc13ecd9ab26355e6d11876368260066efd443ac10cb1027480e2d39c0732028542988fb3d255083fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d343377322cf422e2bc1526fc8794455

SHA1
e882b120e35acf177371ebb1ff72756f9fc3ecac

SHA256
6964cb2dd680a516e453123f1c65de608d9aa0b98c357fad658f0d3c528ba481

SHA512
687bebb527cc3513131de08508cb97c8fa7ab4f7867d20058775930f91ed426f05afed69cd8e1d74339379392c3aa84c87fd98cdd71d848d54c4619237238f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f02cb72ab366b63ba88b9ee3fe62791a

SHA1
c26e13fa5a92deb81ef98fe0f4adf945fbb41e69

SHA256
e95f4f2b7a20557acc8cd066c5b73d4610477fcb5e6e081400859ec6e74e052f

SHA512
ae896997b3d6b8782f982a9253b94ff06da0bd195926232a1b6864fa13a261441937572250a754f20db31efdb45c0c3bfa507f44b74ab116466a68a4713446eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
769c377c69513c98afbb8e8a73f987da

SHA1
778c71cd934b16934a28a1509aa0e6bef3eecb47

SHA256
05806dd4d566562913a2d9f827759fe3611d8d2084f83b2d9744406d5631c031

SHA512
97dd4cdaa56db32daeed674919853ef9db8fa427302bb2932231146b35454b3fc807fb81afe503b3b287e89b03e3e2a48a435b04c583b6fbaf641756f409777d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a8a63d1a9455b5dfd78bb6a8d3dae8d6

SHA1
a0308bd6b13ab83029415c8335132a52f44a4ca6

SHA256
e671d4f8f15d3c9d5d426224a49f0b9145c71212646cd12d931b36bbeda7d975

SHA512
99c26f860d193412c45ffbd7bbe71090ed0af5314251ac4069baf96841e10b6b34f601c113ce0bfbd463f9d090334de44dcd84146d0a4f6f534ca94550457cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
795c20c4bb745943f3d329022a424cfa

SHA1
54b0d492f29559147b5b566807d26db1c375026c

SHA256
ae68a1440e5761b44caa8204291e89003dbaaa5d97894aa1f926c3219c7462fa

SHA512
ffaa2a7ed1ac9cc139df4907169a78c3458b2df132f0fdf65617a746608e452649ad6b7b6a2efae4a3f428ba46e11d8192887db2e3d9512d3f505681d3a7d06c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
29eb1a57c03748af6012570dc05080c4

SHA1
b84f342e37ff1f0915694cc2b582f3fb2074c09b

SHA256
168cb4ff07f4c12b001746bc14be09a06228555efe0146bb57becbb965711cf5

SHA512
cae2d75f6416402b71708ad413752c81d549a911aea33b515cb7ec907b1954a1f0701ae419804504431e570cf61e190d46771abd0a58d133bf657413ae35b018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8a8.TMP

Filesize
1KB

MD5
a19dd4c992f5d3fe288cfc6cf1730194

SHA1
659b5f35a1168aade16c7a61790b7d15dd20d411

SHA256
f79b45159b72b68d79c45016fe6bc123c061edfde3c8572ba8e1c7dc8bbd9290

SHA512
c28e9c2e7e0c329a6330ca19e8b499b0378de58059768966748e4c6a9d54c071ac6a92cdccc88d34c105bfd6e9b0396ced9d8e1d2f73c408d98486a7636bc590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
986db929ab52769e3e0ceb18edd6f6c1

SHA1
bfcf92f425907b509bd02d1cd0e16c66bae7fefd

SHA256
ce2953d9e046cba3b7bdc84203fa8982f50bbc243e0141d4a2a1e9713dd6cb7d

SHA512
22cf7b6fc52cc2d8d21ebd2316554c00bc0eab27bf151b1120f2df6c0ac78eabb6cd10c4e65a7d2b668f7b01372c070dda44653e91a102c11e814d2cd1a9109c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6fd4b6503eefb8b16c3a230e05150423

SHA1
013e80494008959db5bc43a01c0010dfef03b39d

SHA256
a0077f002c8c38dfdd036fd1e9146218d1a60e04fa2a8600e20eabe81fde77d5

SHA512
b49d4ba53b429a63d9163f20893874fab6455ffdfb0ad73d58ae062a121a3ba88fe10d2ac7ec6d966b2a472bc359434325562585f2bdee5bec8528af9efe35c2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 472323.crdownload

Filesize
13.4MB

MD5
6fe0bb4598fba38e1c2dc25b084ae38e

SHA1
7514257cc85b0a2d4b218f43f9a8f4dd61c545cf

SHA256
ceaed51bfaf0862e89a1790376ff6969bcc7c266e2c7b73cf67f57ad3ca7a397

SHA512
232b90973680eadbf11851fa20dc1e0ffbcae86f14bd8b605964a593775705cdc69dcb3cd9a5ab66ce18785c2a098df75f58392b1c3d6a04f28c57541fdc632b

Download Submit
memory/3928-400-0x0000000003A30000-0x0000000003E30000-memory.dmp

Filesize
4.0MB

Download
memory/3928-398-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3928-404-0x0000000075210000-0x0000000075425000-memory.dmp

Filesize
2.1MB

Download
memory/3928-401-0x0000000003A30000-0x0000000003E30000-memory.dmp

Filesize
4.0MB

Download
memory/3928-402-0x00007FFDCCCF0000-0x00007FFDCCEE5000-memory.dmp

Filesize
2.0MB

Download
memory/3928-397-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4648-422-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-418-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-419-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-421-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-420-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-423-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-417-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-413-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-411-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4648-412-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Filesize
4KB

Download
memory/4712-410-0x0000000075210000-0x0000000075425000-memory.dmp

Filesize
2.1MB

Download
memory/4712-407-0x00000000021F0000-0x00000000025F0000-memory.dmp

Filesize
4.0MB

Download
memory/4712-408-0x00007FFDCCCF0000-0x00007FFDCCEE5000-memory.dmp

Filesize
2.0MB

Download
memory/4712-405-0x00000000004E0000-0x00000000004E9000-memory.dmp

Filesize
36KB

Download
memory/5068-396-0x0000000005CF0000-0x0000000005D12000-memory.dmp

Filesize
136KB

Download
memory/5068-395-0x0000000006520000-0x0000000006AC4000-memory.dmp

Filesize
5.6MB

Download
memory/5068-394-0x0000000005E50000-0x0000000005F70000-memory.dmp

Filesize
1.1MB

Download
memory/5068-393-0x0000000005D60000-0x0000000005DFC000-memory.dmp

Filesize
624KB

Download
memory/5068-392-0x0000000000FD0000-0x00000000013A8000-memory.dmp

Filesize
3.8MB

Download