Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 22:34
Behavioral task
behavioral1
Sample
Solara/SolaraBootstrapper.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Solara/SolaraBootstrapper.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Solara/bin/api.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Solara/bin/api.dll
Resource
win10v2004-20240802-en
General
-
Target
Solara/SolaraBootstrapper.exe
-
Size
309KB
-
MD5
becc7a2510958905e91572f6259079fc
-
SHA1
885ef041f4f6c37a68752f246fc70a7b440e4d64
-
SHA256
2b424e128aaaa7ea88e6076e72516d60e149a6cfe20e861191e261b4bcd743d9
-
SHA512
cbfa0892764a588d4837d7c1c37407c5999bcadc6770a0885e54493457fff8b256a19af2bd6e08e7e042f67bb6b1f3c63a21e71c47af33b463f1a7863725ad01
-
SSDEEP
6144:YTxVlfJeX2+LOO1EuN1o1j0v2fA9LnH9niSr5QR0ZyeIxYhH9XDQc4/Q:YTblfJemsOONOj03UO5y0ZUxu9
Malware Config
Extracted
redline
185.196.9.26:6302
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2884-14-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2884-16-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2884-11-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2884-8-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2884-7-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SolaraBootstrapper.exedescription pid process target process PID 2444 set thread context of 2884 2444 SolaraBootstrapper.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
SolaraBootstrapper.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SolaraBootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exepid process 2884 RegAsm.exe 2884 RegAsm.exe 2884 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
RegAsm.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 2884 RegAsm.exe Token: 33 1280 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1280 AUDIODG.EXE Token: 33 1280 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1280 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SolaraBootstrapper.exedescription pid process target process PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe PID 2444 wrote to memory of 2884 2444 SolaraBootstrapper.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBootstrapper.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2396
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1e41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280