Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 19:35
Behavioral task
behavioral1
Sample
Solaraً/Bootstrapperً.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Solaraً/Bootstrapperً.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Solaraً/bin/api.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Solaraً/bin/api.dll
Resource
win10v2004-20240802-en
General
-
Target
Solaraً/Bootstrapperً.exe
-
Size
502KB
-
MD5
7461b0c49f96d52fe0b2c0176e0aa275
-
SHA1
24116687fc970ffc24239838d61f294ff4c2b041
-
SHA256
4df54a234bc14ecd805d807271895be6e3115206a9a07dbc2d3c9fb9567b99b9
-
SHA512
76502a5b1f7e2243e6fcc969c7121694bffc7e5039c0f5a257eddd9aca744acf17a819c4a48fdb29fedf51e5a70e1929c81895e08e5afff2e21006590af3a5ce
-
SSDEEP
12288:0gUgsiwptTLgEiBKWaAEmGQL7/yg/cKTlLolg+:QFptTWBKFAEmGQLugECx
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bootstrapperً.exedescription pid process target process PID 2668 set thread context of 1932 2668 Bootstrapperً.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Bootstrapperً.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bootstrapperً.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 1932 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RegAsm.exedescription pid process Token: SeBackupPrivilege 1932 RegAsm.exe Token: SeSecurityPrivilege 1932 RegAsm.exe Token: SeSecurityPrivilege 1932 RegAsm.exe Token: SeSecurityPrivilege 1932 RegAsm.exe Token: SeSecurityPrivilege 1932 RegAsm.exe Token: SeDebugPrivilege 1932 RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Bootstrapperً.exedescription pid process target process PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe PID 2668 wrote to memory of 1932 2668 Bootstrapperً.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solaraً\Bootstrapperً.exe"C:\Users\Admin\AppData\Local\Temp\Solaraً\Bootstrapperً.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b