Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 22:08
Behavioral task
behavioral1
Sample
a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe
Resource
win10v2004-20240802-en
General
-
Target
a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe
-
Size
469KB
-
MD5
58c1d6a53fc99b39fda4a93d75d886f9
-
SHA1
fa83cdf828a87aed7b25268d5e41e6e0fc2ef7f0
-
SHA256
a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d
-
SHA512
b3dee6eb5f5de7ba3925f7cd757faa739f84cda1765e8dd138a024fc6ab2cb4573aabc8cf612f7deca7f0a64df2291074028da99823b79cc985609335253d5b3
-
SSDEEP
12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSeDn9:uiLJbpI7I2WhQqZ7eD9
Malware Config
Extracted
remcos
RemoteHost
accessories-retrieve.gl.at.ply.gg:13970
192.168.1.56:13970
accessories-retrieve.gl.at.ply.gg:9999
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Solara2.exe
-
copy_folder
Health
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
filer32
-
keylog_path
%WinDir%\System32
-
mouse_option
false
-
mutex
Rmc-7ARNVK
-
screenshot_crypt
true
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%WinDir%\System32
-
screenshot_time
10
-
startup_value
WindowsHealth
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Solara2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" Solara2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" iexplore.exe -
Deletes itself 1 IoCs
pid Process 2344 WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 Solara2.exe -
Loads dropped DLL 2 IoCs
pid Process 544 cmd.exe 544 cmd.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" Solara2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" Solara2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsHealth = "\"C:\\Windows\\SysWOW64\\Health\\Solara2.exe\"" iexplore.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Health a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe File created C:\Windows\SysWOW64\Screenshots\time_20240917_220833.dat iexplore.exe File opened for modification C:\Windows\SysWOW64\filer32\logs.dat iexplore.exe File created C:\Windows\SysWOW64\filer32\logs.dat iexplore.exe File created C:\Windows\SysWOW64\Health\Solara2.exe a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe File opened for modification C:\Windows\SysWOW64\Health\Solara2.exe a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2708 set thread context of 2276 2708 Solara2.exe 38 PID 2276 set thread context of 2668 2276 iexplore.exe 45 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Solara2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 2392 reg.exe 2848 reg.exe 2876 reg.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2708 Solara2.exe 2276 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2552 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 30 PID 2128 wrote to memory of 2552 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 30 PID 2128 wrote to memory of 2552 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 30 PID 2128 wrote to memory of 2552 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 30 PID 2552 wrote to memory of 2392 2552 cmd.exe 32 PID 2552 wrote to memory of 2392 2552 cmd.exe 32 PID 2552 wrote to memory of 2392 2552 cmd.exe 32 PID 2552 wrote to memory of 2392 2552 cmd.exe 32 PID 2128 wrote to memory of 2344 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 33 PID 2128 wrote to memory of 2344 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 33 PID 2128 wrote to memory of 2344 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 33 PID 2128 wrote to memory of 2344 2128 a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe 33 PID 2344 wrote to memory of 544 2344 WScript.exe 34 PID 2344 wrote to memory of 544 2344 WScript.exe 34 PID 2344 wrote to memory of 544 2344 WScript.exe 34 PID 2344 wrote to memory of 544 2344 WScript.exe 34 PID 544 wrote to memory of 2708 544 cmd.exe 36 PID 544 wrote to memory of 2708 544 cmd.exe 36 PID 544 wrote to memory of 2708 544 cmd.exe 36 PID 544 wrote to memory of 2708 544 cmd.exe 36 PID 2708 wrote to memory of 2348 2708 Solara2.exe 37 PID 2708 wrote to memory of 2348 2708 Solara2.exe 37 PID 2708 wrote to memory of 2348 2708 Solara2.exe 37 PID 2708 wrote to memory of 2348 2708 Solara2.exe 37 PID 2708 wrote to memory of 2276 2708 Solara2.exe 38 PID 2708 wrote to memory of 2276 2708 Solara2.exe 38 PID 2708 wrote to memory of 2276 2708 Solara2.exe 38 PID 2708 wrote to memory of 2276 2708 Solara2.exe 38 PID 2708 wrote to memory of 2276 2708 Solara2.exe 38 PID 2348 wrote to memory of 2848 2348 cmd.exe 40 PID 2348 wrote to memory of 2848 2348 cmd.exe 40 PID 2348 wrote to memory of 2848 2348 cmd.exe 40 PID 2348 wrote to memory of 2848 2348 cmd.exe 40 PID 2276 wrote to memory of 2860 2276 iexplore.exe 41 PID 2276 wrote to memory of 2860 2276 iexplore.exe 41 PID 2276 wrote to memory of 2860 2276 iexplore.exe 41 PID 2276 wrote to memory of 2860 2276 iexplore.exe 41 PID 2860 wrote to memory of 2876 2860 cmd.exe 44 PID 2860 wrote to memory of 2876 2860 cmd.exe 44 PID 2860 wrote to memory of 2876 2860 cmd.exe 44 PID 2860 wrote to memory of 2876 2860 cmd.exe 44 PID 2276 wrote to memory of 2668 2276 iexplore.exe 45 PID 2276 wrote to memory of 2668 2276 iexplore.exe 45 PID 2276 wrote to memory of 2668 2276 iexplore.exe 45 PID 2276 wrote to memory of 2668 2276 iexplore.exe 45 PID 2276 wrote to memory of 2668 2276 iexplore.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe"C:\Users\Admin\AppData\Local\Temp\a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2392
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\Health\Solara2.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\Health\Solara2.exeC:\Windows\SysWOW64\Health\Solara2.exe4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2848
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2876
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵PID:2668
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
638B
MD5fa9d21bb5f1f6becce439f2a64155aba
SHA17acb9694231af658cf8d363873b3727a9d901b73
SHA256a25eb332568fccab1714f38e9e2affe1b7902f224f106988cff335e45b51991c
SHA512fe93d109b031dbc23c0a2a161a25fa2a80f3d3220fb6dbd72934367f46dc65f23d06fe543f8683b3b32adeb3a0789d32cf408a161a02e60be9c0e882bc4b4749
-
Filesize
260B
MD5633fe3d7c2dc1bf8a9350ffa742e922e
SHA136028e8a994d32557d8d2df2bd8fa37c2b415212
SHA256e9936c59a35bdb529fff7780a7a94cc6253fd2eff56e7950b0429fa5f6e790e9
SHA51274b6800d9936152727488e964ad79a6216041130d734574370f42bce6fd39ea9c70d1b719bd628bdd657f0a846f1a1ac9ed0ce70654b9ba3dc93780217a66389
-
Filesize
469KB
MD558c1d6a53fc99b39fda4a93d75d886f9
SHA1fa83cdf828a87aed7b25268d5e41e6e0fc2ef7f0
SHA256a5f81a6aab1ec4f11a07c8f5c1a981363017341eddcd7f8a7569acb3856ce78d
SHA512b3dee6eb5f5de7ba3925f7cd757faa739f84cda1765e8dd138a024fc6ab2cb4573aabc8cf612f7deca7f0a64df2291074028da99823b79cc985609335253d5b3