Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 20:52
General
-
Target
SolaraFixer.exe
-
Size
231KB
-
MD5
8bef46b57ddddec3d0d140f6f8d4b68e
-
SHA1
549b51f7d1106f186de8d3594d55dcac22a6f8fc
-
SHA256
360d3cef3d330c1930e318277939ab1c7db6c969f23be5d385b93f5faef3b4d2
-
SHA512
5e9442c00355f5aea64b787658e7b390e5f53d1709bb4ce951db3e363b91fde46cd70d2262ddd9d06c1e21a72a2728821065d87c213ce86020a620ba468458f7
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4HlYrU69VenbGkFZw36b8e1mzCi:joZtL+EP8HlYrU69VenbGkFZwWeX
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1780-1-0x000002C37AE80000-0x000002C37AEC0000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com 76 ip-api.com -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1780 SolaraFixer.exe Token: SeIncreaseQuotaPrivilege 2104 wmic.exe Token: SeSecurityPrivilege 2104 wmic.exe Token: SeTakeOwnershipPrivilege 2104 wmic.exe Token: SeLoadDriverPrivilege 2104 wmic.exe Token: SeSystemProfilePrivilege 2104 wmic.exe Token: SeSystemtimePrivilege 2104 wmic.exe Token: SeProfSingleProcessPrivilege 2104 wmic.exe Token: SeIncBasePriorityPrivilege 2104 wmic.exe Token: SeCreatePagefilePrivilege 2104 wmic.exe Token: SeBackupPrivilege 2104 wmic.exe Token: SeRestorePrivilege 2104 wmic.exe Token: SeShutdownPrivilege 2104 wmic.exe Token: SeDebugPrivilege 2104 wmic.exe Token: SeSystemEnvironmentPrivilege 2104 wmic.exe Token: SeRemoteShutdownPrivilege 2104 wmic.exe Token: SeUndockPrivilege 2104 wmic.exe Token: SeManageVolumePrivilege 2104 wmic.exe Token: 33 2104 wmic.exe Token: 34 2104 wmic.exe Token: 35 2104 wmic.exe Token: 36 2104 wmic.exe Token: SeIncreaseQuotaPrivilege 2104 wmic.exe Token: SeSecurityPrivilege 2104 wmic.exe Token: SeTakeOwnershipPrivilege 2104 wmic.exe Token: SeLoadDriverPrivilege 2104 wmic.exe Token: SeSystemProfilePrivilege 2104 wmic.exe Token: SeSystemtimePrivilege 2104 wmic.exe Token: SeProfSingleProcessPrivilege 2104 wmic.exe Token: SeIncBasePriorityPrivilege 2104 wmic.exe Token: SeCreatePagefilePrivilege 2104 wmic.exe Token: SeBackupPrivilege 2104 wmic.exe Token: SeRestorePrivilege 2104 wmic.exe Token: SeShutdownPrivilege 2104 wmic.exe Token: SeDebugPrivilege 2104 wmic.exe Token: SeSystemEnvironmentPrivilege 2104 wmic.exe Token: SeRemoteShutdownPrivilege 2104 wmic.exe Token: SeUndockPrivilege 2104 wmic.exe Token: SeManageVolumePrivilege 2104 wmic.exe Token: 33 2104 wmic.exe Token: 34 2104 wmic.exe Token: 35 2104 wmic.exe Token: 36 2104 wmic.exe Token: SeDebugPrivilege 3392 SolaraFixer.exe Token: SeIncreaseQuotaPrivilege 2020 wmic.exe Token: SeSecurityPrivilege 2020 wmic.exe Token: SeTakeOwnershipPrivilege 2020 wmic.exe Token: SeLoadDriverPrivilege 2020 wmic.exe Token: SeSystemProfilePrivilege 2020 wmic.exe Token: SeSystemtimePrivilege 2020 wmic.exe Token: SeProfSingleProcessPrivilege 2020 wmic.exe Token: SeIncBasePriorityPrivilege 2020 wmic.exe Token: SeCreatePagefilePrivilege 2020 wmic.exe Token: SeBackupPrivilege 2020 wmic.exe Token: SeRestorePrivilege 2020 wmic.exe Token: SeShutdownPrivilege 2020 wmic.exe Token: SeDebugPrivilege 2020 wmic.exe Token: SeSystemEnvironmentPrivilege 2020 wmic.exe Token: SeRemoteShutdownPrivilege 2020 wmic.exe Token: SeUndockPrivilege 2020 wmic.exe Token: SeManageVolumePrivilege 2020 wmic.exe Token: 33 2020 wmic.exe Token: 34 2020 wmic.exe Token: 35 2020 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2104 1780 SolaraFixer.exe 85 PID 1780 wrote to memory of 2104 1780 SolaraFixer.exe 85 PID 3392 wrote to memory of 2020 3392 SolaraFixer.exe 115 PID 3392 wrote to memory of 2020 3392 SolaraFixer.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58094b248fe3231e48995c2be32aeb08c
SHA12fe06e000ebec919bf982d033c5d1219c1f916b6
SHA256136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc
SHA512bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f