Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
Solara.exe
-
Size
1.4MB
-
MD5
8c6298202dd74e77b238f50a26a07233
-
SHA1
6d71bb75a517e873a16398330dcda437cde26e6d
-
SHA256
7cc4643e4b4a49820cb461ef005e129363c3336b9d28dde1aa397b7118f709f0
-
SHA512
7856dee0adb985ef521e2c7ff7a1ffeb9b39f18743e2c18ad9cd3f6f9b87a70a1f9fde108492b8362b67910e82c9c18be57af65f8f2c5d90ed5494873ede96b1
-
SSDEEP
24576:j6F4Df9Gpethg/Md+54x8C2p1ywbxpPzgXSX+O0b33fzEhsx7wHJL08b1YLl5wmr:j6FKf9Gwhg/++W6bp1rbxpPzJLu38sxl
Malware Config
Extracted
Family
meduza
C2
127.0.0.1
Signatures
-
Meduza Stealer payload 8 IoCs
resource yara_rule behavioral1/memory/2828-16-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza behavioral1/memory/2828-22-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza behavioral1/memory/2828-23-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza behavioral1/memory/2828-18-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza behavioral1/memory/2828-14-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza behavioral1/memory/2828-12-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza behavioral1/memory/2828-10-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza behavioral1/memory/2828-8-0x0000000140000000-0x0000000140103000-memory.dmp family_meduza -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\International\Geo\Nation Solara.exe -
Loads dropped DLL 1 IoCs
pid Process 2772 Solara.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2772 set thread context of 2828 2772 Solara.exe 31 -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\a.exe:extractor.dll Solara.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31 PID 2772 wrote to memory of 2828 2772 Solara.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"2⤵
- Checks computer location settings
PID:2828
-