Overview
overview
10Static
static
10solara/run...ra.bat
windows7-x64
3solara/run...ra.bat
windows10-2004-x64
3solara/run.bat
windows7-x64
1solara/run.bat
windows10-2004-x64
1solara/solara.dll
windows7-x64
3solara/solara.dll
windows10-2004-x64
10solara/solara fix.exe
windows7-x64
10solara/solara fix.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 10:17
Behavioral task
behavioral1
Sample
solara/run to start solara.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
solara/run to start solara.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
solara/run.bat
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
solara/run.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
solara/solara.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
solara/solara.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
solara/solara fix.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
solara/solara fix.exe
Resource
win10v2004-20241007-en
General
-
Target
solara/solara.dll
-
Size
164KB
-
MD5
6e3efb83299d800edf1624ecbc0665e7
-
SHA1
0bd22f204c5373f1a22d9a02c59f69f354a2cc0d
-
SHA256
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6
-
SHA512
dd1675bb15eb8ea2933b25413271117823ad7ff38280e7f552b5201e3a5bef8607a2112df2e24f598449ebfdb570ff9458aba0314ed8819dd4d774ea855e9ad2
-
SSDEEP
3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfU9ECs5p:FWe29/GuzjmfCHWtUiCs5p
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2936 2500 rundll32.exe 30 PID 2500 wrote to memory of 2936 2500 rundll32.exe 30 PID 2500 wrote to memory of 2936 2500 rundll32.exe 30 PID 2500 wrote to memory of 2936 2500 rundll32.exe 30 PID 2500 wrote to memory of 2936 2500 rundll32.exe 30 PID 2500 wrote to memory of 2936 2500 rundll32.exe 30 PID 2500 wrote to memory of 2936 2500 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\solara\solara.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\solara\solara.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2936
-