Overview

overview

10

Static

static

10

Solara.exe

windows7-x64

7

Solara.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Solara.exe

  • Size

    7.8MB

  • Sample

    241027-g1zq7awanm

  • MD5

    95f2386ae3e4429f2a4a5ebdc1debdb8

  • SHA1

    9b9972251297aa592ccc1abbd6ada957ef831dac

  • SHA256

    02c5a79468f60a41ea9a6220444036e1da08471c5bb87de5e1e91c3504b198cb

  • SHA512

    9af023257e018259f5a504db664819efa04d2bb29b0958502f3c838deb79a7f3edcd210bc796b43e2e44d17bc212714894b97cd51ffca3ebf2415f39aad2b25e

  • SSDEEP

    196608:hK0WMeNTfm/pf+xk4dNSESRpmrbW3jmrK:Iy/pWu4m5RpmrbmyrK

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      Solara.exe

    • Size

      7.8MB

    • MD5

      95f2386ae3e4429f2a4a5ebdc1debdb8

    • SHA1

      9b9972251297aa592ccc1abbd6ada957ef831dac

    • SHA256

      02c5a79468f60a41ea9a6220444036e1da08471c5bb87de5e1e91c3504b198cb

    • SHA512

      9af023257e018259f5a504db664819efa04d2bb29b0958502f3c838deb79a7f3edcd210bc796b43e2e44d17bc212714894b97cd51ffca3ebf2415f39aad2b25e

    • SSDEEP

      196608:hK0WMeNTfm/pf+xk4dNSESRpmrbW3jmrK:Iy/pWu4m5RpmrbmyrK

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks