rhadamanthys | hxxps://github[.]com/Clodio23/Solara-Executor

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Clodio23/Solara-Executor
Sample240902-vb4whaverh

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://144.76.133.166:8034/5502b8a765a7d7349/k5851jfq.guti6

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3928 created 2468	3928	Solara.exe	42

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	camo.githubusercontent.com
36	camo.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 3928	5068	Solara.exe	123

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4856	3928	WerFault.exe	123
3284	3928	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
840	msedge.exe
840	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
4212	msedge.exe
4212	msedge.exe
3928	Solara.exe
3928	Solara.exe
4712	openwith.exe
4712	openwith.exe
4712	openwith.exe
4712	openwith.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	taskmgr.exe
Token: SeSystemProfilePrivilege	4648	taskmgr.exe
Token: SeCreateGlobalPrivilege	4648	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe
4648	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 468	840	msedge.exe	83
PID 840 wrote to memory of 468	840	msedge.exe	83
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 744	840	msedge.exe	84
PID 840 wrote to memory of 1464	840	msedge.exe	85
PID 840 wrote to memory of 1464	840	msedge.exe	85
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86
PID 840 wrote to memory of 2280	840	msedge.exe	86

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2468
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Clodio23/Solara-Executor
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbdec46f8,0x7ffdbdec4708,0x7ffdbdec4718
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5173049742236438269,16913390017828209442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3000

C:\Users\Admin\Desktop\Solara\Solara.exe
"C:\Users\Admin\Desktop\Solara\Solara.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5068
- C:\Users\Admin\Desktop\Solara\Solara.exe
  "C:\Users\Admin\Desktop\Solara\Solara.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 496
    3⤵
    - Program crash
    PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 504
    3⤵
    - Program crash
    PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3928 -ip 3928
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3928 -ip 3928
1⤵
PID:3240

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6d5893262a38e52dd56b9d1486a70f6e21a167d3638ad4814548cbcc8bfff9f8
MD5 bee17175e812d89c0348f806e9734bb4
SHA1 7dbc9dd0a70ff41c1592c07afb25ca2ca8d57bf2
SHA512 128bf82d4f5e312b6c6fa64e2040826ab142fee5ea1f605a4b6627f825bef53e09a8fd2bdb9b1929b73c02cd755d6d489dcfd59542f162a79efe2b1601fb5acb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 679B
SHA256 889f30c8ed2501a80f17df85b7810d81f504fb9cde82c48da11d75b8d54537f8
MD5 6e0c732ea8c1954b30a4ced82247e4c4
SHA1 b44b6a0d4021cf33dccd4e861b5ffae563b83385
SHA512 893bd4547c75efa94d99f765a0e50186baed283412fb3fe81270d4f1c46b9c8ba33572a98f662585a3de67d1cd368cba0dd7835b27aa10159aa2f3985de83ae5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6d7e6f6946a40a5202a83ad2eac3bb5dd3d9c50c486ab349a66fff3f68dc2760
MD5 ddaf949fd49a3049fea0b19ccff5c9df
SHA1 c42358a15acd81aa0c798fb921a68b29f3d4918d
SHA512 d9e6dc72c4b173f926e7048aa092dcf11311ec12b612cefc13ecd9ab26355e6d11876368260066efd443ac10cb1027480e2d39c0732028542988fb3d255083fd
SSDEEP 96:nH/kRau1OgdwpvWMoiVmdeH/ddoUWQyV+VDCziEwb:nH/kR9oWGWMX1Kro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6964cb2dd680a516e453123f1c65de608d9aa0b98c357fad658f0d3c528ba481
MD5 d343377322cf422e2bc1526fc8794455
SHA1 e882b120e35acf177371ebb1ff72756f9fc3ecac
SHA512 687bebb527cc3513131de08508cb97c8fa7ab4f7867d20058775930f91ed426f05afed69cd8e1d74339379392c3aa84c87fd98cdd71d848d54c4619237238f5f
SSDEEP 96:nH/kRou12IdwpvWMoilR5mde+btMF0JVdeoUWQyV+VD7AiEwb:nH/kRfsOGWMlQbt7JDrrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e95f4f2b7a20557acc8cd066c5b73d4610477fcb5e6e081400859ec6e74e052f
MD5 f02cb72ab366b63ba88b9ee3fe62791a
SHA1 c26e13fa5a92deb81ef98fe0f4adf945fbb41e69
SHA512 ae896997b3d6b8782f982a9253b94ff06da0bd195926232a1b6864fa13a261441937572250a754f20db31efdb45c0c3bfa507f44b74ab116466a68a4713446eb
SSDEEP 96:nH/k8sQ9Ku120dwpvWMoiWRZR5mdeWqJnCMHyJVdwF4yWQyV+VD7AiEwb:nH/kwsyGWMWbwqJnCXJDwGlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 05806dd4d566562913a2d9f827759fe3611d8d2084f83b2d9744406d5631c031
MD5 769c377c69513c98afbb8e8a73f987da
SHA1 778c71cd934b16934a28a1509aa0e6bef3eecb47
SHA512 97dd4cdaa56db32daeed674919853ef9db8fa427302bb2932231146b35454b3fc807fb81afe503b3b287e89b03e3e2a48a435b04c583b6fbaf641756f409777d
SSDEEP 96:nH/kRou1OIdwpvWMoiVmdePu9S1j/d7oUWQyV+VD7AiEwb:nH/kRfoOGWMfu0h1Mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e671d4f8f15d3c9d5d426224a49f0b9145c71212646cd12d931b36bbeda7d975
MD5 a8a63d1a9455b5dfd78bb6a8d3dae8d6
SHA1 a0308bd6b13ab83029415c8335132a52f44a4ca6
SHA512 99c26f860d193412c45ffbd7bbe71090ed0af5314251ac4069baf96841e10b6b34f601c113ce0bfbd463f9d090334de44dcd84146d0a4f6f534ca94550457cdd
SSDEEP 96:nH/k8sQ/ou12IdwpvWMoilR5mdeWqJnCMHyJVdlFoUWQyV+VD7AiEwb:nH/kSfsOGWMlwqJnCXJDlCrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 ae68a1440e5761b44caa8204291e89003dbaaa5d97894aa1f926c3219c7462fa
MD5 795c20c4bb745943f3d329022a424cfa
SHA1 54b0d492f29559147b5b566807d26db1c375026c
SHA512 ffaa2a7ed1ac9cc139df4907169a78c3458b2df132f0fdf65617a746608e452649ad6b7b6a2efae4a3f428ba46e11d8192887db2e3d9512d3f505681d3a7d06c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 168cb4ff07f4c12b001746bc14be09a06228555efe0146bb57becbb965711cf5
MD5 29eb1a57c03748af6012570dc05080c4
SHA1 b84f342e37ff1f0915694cc2b582f3fb2074c09b
SHA512 cae2d75f6416402b71708ad413752c81d549a911aea33b515cb7ec907b1954a1f0701ae419804504431e570cf61e190d46771abd0a58d133bf657413ae35b018
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57f8a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8a8.TMP
Size 1KB
SHA256 f79b45159b72b68d79c45016fe6bc123c061edfde3c8572ba8e1c7dc8bbd9290
MD5 a19dd4c992f5d3fe288cfc6cf1730194
SHA1 659b5f35a1168aade16c7a61790b7d15dd20d411
SHA512 c28e9c2e7e0c329a6330ca19e8b499b0378de58059768966748e4c6a9d54c071ac6a92cdccc88d34c105bfd6e9b0396ced9d8e1d2f73c408d98486a7636bc590
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ce2953d9e046cba3b7bdc84203fa8982f50bbc243e0141d4a2a1e9713dd6cb7d
MD5 986db929ab52769e3e0ceb18edd6f6c1
SHA1 bfcf92f425907b509bd02d1cd0e16c66bae7fefd
SHA512 22cf7b6fc52cc2d8d21ebd2316554c00bc0eab27bf151b1120f2df6c0ac78eabb6cd10c4e65a7d2b668f7b01372c070dda44653e91a102c11e814d2cd1a9109c
SSDEEP 192:9oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4xe2RUvST3I0Rw5Ytj9Zkb:x9iIxuERzA83h09RZxYcm6YvkLs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a0077f002c8c38dfdd036fd1e9146218d1a60e04fa2a8600e20eabe81fde77d5
MD5 6fd4b6503eefb8b16c3a230e05150423
SHA1 013e80494008959db5bc43a01c0010dfef03b39d
SHA512 b49d4ba53b429a63d9163f20893874fab6455ffdfb0ad73d58ae062a121a3ba88fe10d2ac7ec6d966b2a472bc359434325562585f2bdee5bec8528af9efe35c2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4Ye2RUW23I0Rw5Ytj9ZklB:A9iIxuERzA83h09RZxYrmYvkLs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 472323.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 472323.crdownload
Size 13.4MB
SHA256 ceaed51bfaf0862e89a1790376ff6969bcc7c266e2c7b73cf67f57ad3ca7a397
MD5 6fe0bb4598fba38e1c2dc25b084ae38e
SHA1 7514257cc85b0a2d4b218f43f9a8f4dd61c545cf
SHA512 232b90973680eadbf11851fa20dc1e0ffbcae86f14bd8b605964a593775705cdc69dcb3cd9a5ab66ce18785c2a098df75f58392b1c3d6a04f28c57541fdc632b
SSDEEP 393216:+H7gx90ywmq3gvGQ1HUPri1xktbsUjOBo+mt:u7e92v+PRUDi1QvaoTt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3928-400-0x0000000003A30000-0x0000000003E30000-memory.dmp

Download

memory/3928-398-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3928-404-0x0000000075210000-0x0000000075425000-memory.dmp

Download

memory/3928-401-0x0000000003A30000-0x0000000003E30000-memory.dmp

Download

memory/3928-402-0x00007FFDCCCF0000-0x00007FFDCCEE5000-memory.dmp

Download

memory/3928-397-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4648-422-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-418-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-419-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-421-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-420-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-423-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-417-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-413-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-411-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4648-412-0x0000021AB69A0000-0x0000021AB69A1000-memory.dmp

Download

memory/4712-410-0x0000000075210000-0x0000000075425000-memory.dmp

Download

memory/4712-407-0x00000000021F0000-0x00000000025F0000-memory.dmp

Download

memory/4712-408-0x00007FFDCCCF0000-0x00007FFDCCEE5000-memory.dmp

Download

memory/4712-405-0x00000000004E0000-0x00000000004E9000-memory.dmp

Download

memory/5068-396-0x0000000005CF0000-0x0000000005D12000-memory.dmp

Download

memory/5068-395-0x0000000006520000-0x0000000006AC4000-memory.dmp

Download

memory/5068-394-0x0000000005E50000-0x0000000005F70000-memory.dmp

Download

memory/5068-393-0x0000000005D60000-0x0000000005DFC000-memory.dmp

Download

memory/5068-392-0x0000000000FD0000-0x00000000013A8000-memory.dmp

Download