Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
26-10-2024 12:46
Behavioral task
behavioral1
Sample
SolaraFixer.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
General
-
Target
SolaraFixer.exe
-
Size
231KB
-
MD5
8bef46b57ddddec3d0d140f6f8d4b68e
-
SHA1
549b51f7d1106f186de8d3594d55dcac22a6f8fc
-
SHA256
360d3cef3d330c1930e318277939ab1c7db6c969f23be5d385b93f5faef3b4d2
-
SHA512
5e9442c00355f5aea64b787658e7b390e5f53d1709bb4ce951db3e363b91fde46cd70d2262ddd9d06c1e21a72a2728821065d87c213ce86020a620ba468458f7
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4HlYrU69VenbGkFZw36b8e1mzCi:joZtL+EP8HlYrU69VenbGkFZwWeX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1596-1-0x0000000000900000-0x0000000000940000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1596 SolaraFixer.exe Token: SeIncreaseQuotaPrivilege 2760 wmic.exe Token: SeSecurityPrivilege 2760 wmic.exe Token: SeTakeOwnershipPrivilege 2760 wmic.exe Token: SeLoadDriverPrivilege 2760 wmic.exe Token: SeSystemProfilePrivilege 2760 wmic.exe Token: SeSystemtimePrivilege 2760 wmic.exe Token: SeProfSingleProcessPrivilege 2760 wmic.exe Token: SeIncBasePriorityPrivilege 2760 wmic.exe Token: SeCreatePagefilePrivilege 2760 wmic.exe Token: SeBackupPrivilege 2760 wmic.exe Token: SeRestorePrivilege 2760 wmic.exe Token: SeShutdownPrivilege 2760 wmic.exe Token: SeDebugPrivilege 2760 wmic.exe Token: SeSystemEnvironmentPrivilege 2760 wmic.exe Token: SeRemoteShutdownPrivilege 2760 wmic.exe Token: SeUndockPrivilege 2760 wmic.exe Token: SeManageVolumePrivilege 2760 wmic.exe Token: 33 2760 wmic.exe Token: 34 2760 wmic.exe Token: 35 2760 wmic.exe Token: SeIncreaseQuotaPrivilege 2760 wmic.exe Token: SeSecurityPrivilege 2760 wmic.exe Token: SeTakeOwnershipPrivilege 2760 wmic.exe Token: SeLoadDriverPrivilege 2760 wmic.exe Token: SeSystemProfilePrivilege 2760 wmic.exe Token: SeSystemtimePrivilege 2760 wmic.exe Token: SeProfSingleProcessPrivilege 2760 wmic.exe Token: SeIncBasePriorityPrivilege 2760 wmic.exe Token: SeCreatePagefilePrivilege 2760 wmic.exe Token: SeBackupPrivilege 2760 wmic.exe Token: SeRestorePrivilege 2760 wmic.exe Token: SeShutdownPrivilege 2760 wmic.exe Token: SeDebugPrivilege 2760 wmic.exe Token: SeSystemEnvironmentPrivilege 2760 wmic.exe Token: SeRemoteShutdownPrivilege 2760 wmic.exe Token: SeUndockPrivilege 2760 wmic.exe Token: SeManageVolumePrivilege 2760 wmic.exe Token: 33 2760 wmic.exe Token: 34 2760 wmic.exe Token: 35 2760 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2760 1596 SolaraFixer.exe 28 PID 1596 wrote to memory of 2760 1596 SolaraFixer.exe 28 PID 1596 wrote to memory of 2760 1596 SolaraFixer.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760
-