Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-10-2024 12:57
Behavioral task
behavioral1
Sample
SolaraFixer.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
General
-
Target
SolaraFixer.exe
-
Size
231KB
-
MD5
8bef46b57ddddec3d0d140f6f8d4b68e
-
SHA1
549b51f7d1106f186de8d3594d55dcac22a6f8fc
-
SHA256
360d3cef3d330c1930e318277939ab1c7db6c969f23be5d385b93f5faef3b4d2
-
SHA512
5e9442c00355f5aea64b787658e7b390e5f53d1709bb4ce951db3e363b91fde46cd70d2262ddd9d06c1e21a72a2728821065d87c213ce86020a620ba468458f7
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4HlYrU69VenbGkFZw36b8e1mzCi:joZtL+EP8HlYrU69VenbGkFZwWeX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1820-1-0x0000000000130000-0x0000000000170000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1820 SolaraFixer.exe Token: SeIncreaseQuotaPrivilege 2944 wmic.exe Token: SeSecurityPrivilege 2944 wmic.exe Token: SeTakeOwnershipPrivilege 2944 wmic.exe Token: SeLoadDriverPrivilege 2944 wmic.exe Token: SeSystemProfilePrivilege 2944 wmic.exe Token: SeSystemtimePrivilege 2944 wmic.exe Token: SeProfSingleProcessPrivilege 2944 wmic.exe Token: SeIncBasePriorityPrivilege 2944 wmic.exe Token: SeCreatePagefilePrivilege 2944 wmic.exe Token: SeBackupPrivilege 2944 wmic.exe Token: SeRestorePrivilege 2944 wmic.exe Token: SeShutdownPrivilege 2944 wmic.exe Token: SeDebugPrivilege 2944 wmic.exe Token: SeSystemEnvironmentPrivilege 2944 wmic.exe Token: SeRemoteShutdownPrivilege 2944 wmic.exe Token: SeUndockPrivilege 2944 wmic.exe Token: SeManageVolumePrivilege 2944 wmic.exe Token: 33 2944 wmic.exe Token: 34 2944 wmic.exe Token: 35 2944 wmic.exe Token: SeIncreaseQuotaPrivilege 2944 wmic.exe Token: SeSecurityPrivilege 2944 wmic.exe Token: SeTakeOwnershipPrivilege 2944 wmic.exe Token: SeLoadDriverPrivilege 2944 wmic.exe Token: SeSystemProfilePrivilege 2944 wmic.exe Token: SeSystemtimePrivilege 2944 wmic.exe Token: SeProfSingleProcessPrivilege 2944 wmic.exe Token: SeIncBasePriorityPrivilege 2944 wmic.exe Token: SeCreatePagefilePrivilege 2944 wmic.exe Token: SeBackupPrivilege 2944 wmic.exe Token: SeRestorePrivilege 2944 wmic.exe Token: SeShutdownPrivilege 2944 wmic.exe Token: SeDebugPrivilege 2944 wmic.exe Token: SeSystemEnvironmentPrivilege 2944 wmic.exe Token: SeRemoteShutdownPrivilege 2944 wmic.exe Token: SeUndockPrivilege 2944 wmic.exe Token: SeManageVolumePrivilege 2944 wmic.exe Token: 33 2944 wmic.exe Token: 34 2944 wmic.exe Token: 35 2944 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2944 1820 SolaraFixer.exe 29 PID 1820 wrote to memory of 2944 1820 SolaraFixer.exe 29 PID 1820 wrote to memory of 2944 1820 SolaraFixer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944
-