Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3So0laradf43uhi.zip
windows10-1703-x64
1READme.txt
windows10-1703-x64
1S0laahgi.zip
windows10-1703-x64
1S0laahgi/S0lara.exe
windows10-1703-x64
10S0laahgi/inDd/bn.pak
windows10-1703-x64
3S0laahgi/inDd/hi.pak
windows10-1703-x64
3S0laahgi/i...v2.dll
windows10-1703-x64
1S0laahgi/i...af.pak
windows10-1703-x64
3S0laahgi/i...am.pak
windows10-1703-x64
3S0laahgi/i...ar.pak
windows10-1703-x64
3S0laahgi/i...bn.pak
windows10-1703-x64
3S0laahgi/i...ca.pak
windows10-1703-x64
3S0laahgi/i...cs.pak
windows10-1703-x64
3S0laahgi/i...da.pak
windows10-1703-x64
3S0laahgi/i...de.ps1
windows10-1703-x64
3S0laahgi/i...el.pak
windows10-1703-x64
3S0laahgi/i...GB.pak
windows10-1703-x64
3S0laahgi/i...US.pak
windows10-1703-x64
3S0laahgi/i...19.pak
windows10-1703-x64
3S0laahgi/i...es.pak
windows10-1703-x64
3S0laahgi/i...et.pak
windows10-1703-x64
3S0laahgi/i...fa.pak
windows10-1703-x64
3S0laahgi/i...fi.pak
windows10-1703-x64
3S0laahgi/i...il.pak
windows10-1703-x64
3S0laahgi/i...fr.pak
windows10-1703-x64
3S0laahgi/i...gu.pak
windows10-1703-x64
3S0laahgi/i...he.pak
windows10-1703-x64
3S0laahgi/i...hi.pak
windows10-1703-x64
1S0laahgi/i...m.html
windows10-1703-x64
4S0laahgi/i...ng.dll
windows10-1703-x64
1S0laahgi/i...ng.dll
windows10-1703-x64
1S0laahgi/i...ng.dll
windows10-1703-x64
1Analysis
-
max time kernel
132s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15/10/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
So0laradf43uhi.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
READme.txt
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
S0laahgi.zip
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
S0laahgi/S0lara.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
S0laahgi/inDd/bn.pak
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
S0laahgi/inDd/hi.pak
Resource
win10-20240611-en
Behavioral task
behavioral7
Sample
S0laahgi/inDd/libGLESv2.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
S0laahgi/inDd/locales/af.pak
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
S0laahgi/inDd/locales/am.pak
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
S0laahgi/inDd/locales/ar.pak
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
S0laahgi/inDd/locales/bn.pak
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
S0laahgi/inDd/locales/ca.pak
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
S0laahgi/inDd/locales/cs.pak
Resource
win10-20240611-en
Behavioral task
behavioral14
Sample
S0laahgi/inDd/locales/da.pak
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
S0laahgi/inDd/locales/de.ps1
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
S0laahgi/inDd/locales/el.pak
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
S0laahgi/inDd/locales/en-GB.pak
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
S0laahgi/inDd/locales/en-US.pak
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
S0laahgi/inDd/locales/es-419.pak
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
S0laahgi/inDd/locales/es.pak
Resource
win10-20240611-en
Behavioral task
behavioral21
Sample
S0laahgi/inDd/locales/et.pak
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
S0laahgi/inDd/locales/fa.pak
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
S0laahgi/inDd/locales/fi.pak
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
S0laahgi/inDd/locales/fil.pak
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
S0laahgi/inDd/locales/fr.pak
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
S0laahgi/inDd/locales/gu.pak
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
S0laahgi/inDd/locales/he.pak
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
S0laahgi/inDd/locales/hi.pak
Resource
win10-20240611-en
Behavioral task
behavioral29
Sample
S0laahgi/inDd/resources/LICENSES.chromium.html
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
S0laahgi/inDd/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
S0laahgi/inDd/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
S0laahgi/inDd/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win10-20240404-en
General
-
Target
S0laahgi/S0lara.exe
-
Size
371KB
-
MD5
0eddfde16ed6019e4c12920ebb70bcfb
-
SHA1
6a7397ebd83aff92ca7474f4cccca5ceb592e7fb
-
SHA256
4f5825e0409c1b2a42f2c1db12acbe9f8df7365e9fac7d569e0d4530d1ded2c4
-
SHA512
c4aaaacbb9ffeda289ed6784562b9a7ba6ed96985ab5f595cabf2e86358731f127f3bd101cdfa16249cedc92a501d2120eaf282e491623febc5dbe6af161f1ea
-
SSDEEP
6144:N2R5L8AYOGfl8RWwCtOJE4UkXm9iVe68112twqaZXvw6h:+LAfeRbFJE4+2e6012tUXvw6h
Malware Config
Extracted
lumma
https://drawwyobstacw.sbs
https://condifendteu.sbs
https://ehticsprocw.sbs
https://vennurviot.sbs
https://resinedyw.sbs
https://enlargkiw.sbs
https://allocatinow.sbs
https://mathcucom.sbs
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3912 S0lara.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3912 set thread context of 2600 3912 S0lara.exe 73 -
Program crash 2 IoCs
pid pid_target Process procid_target 3412 2600 WerFault.exe 73 3348 2600 WerFault.exe 73 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language S0lara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73 PID 3912 wrote to memory of 2600 3912 S0lara.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\S0laahgi\S0lara.exe"C:\Users\Admin\AppData\Local\Temp\S0laahgi\S0lara.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 11963⤵
- Program crash
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 12123⤵
- Program crash
PID:3348
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
568KB
MD57b70954fcea25aba0ae8c68ab82139ac
SHA142fcedf5321f15827624d397092ade16bfee2c39
SHA2561b2ae36006211bd467357b4d0d7bc9400d3438e97eab18e7b454462b0fd5872f
SHA512e691457340cbc503c2ad4a1c6d21c8e7f53a9be9204804a6c7f08e6b018abab09901c5d4ea143031b4663df58fc2c7af203ece47967bc6b4ae9d0a551099ede7