quasar | af28db66812bd93b8680039d629844fa8821c0f205285051a50ed4a3bcc7623d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraBootstrapper.exe
Size

3.1MB
MD5

777ed5284b4e0d4305e912b99f618141
SHA1

87453944e39401ceec173a996f88a38af7d70eab
SHA256

af28db66812bd93b8680039d629844fa8821c0f205285051a50ed4a3bcc7623d
SHA512

d5d7e0c0174714b70c642ba4122f2b8f5b6b77fa5b3e291364688c02ddfc3c5c9a3fedd011985779d93a15d7ac018259d33aa1e011e5edca1bd29bf5961727ad
SSDEEP

49152:bvvlL26AaNeWgPhlmVqvMQ7XSKA+RJ6obR3LoGdWTHHB72eh2NT:bv9L26AaNeWgPhlmVqkQ7XSKA+RJ6C

Score

10^/10

quasar nigger discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

nigger

r1ght-46976.portmap.host:46976

Mutex

f9a96516-997d-4ba6-a575-b223308bc6c2

Attributes

encryption_key
2FDC75D59897C5B7FB6BF58E34770B96CFDB9669
install_name
SolaraBootstrapper.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Windows Defender
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4416-1-0x0000000000B70000-0x0000000000E94000-memory.dmp	family_quasar
behavioral2/files/0x0009000000023cb9-6.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe

Executes dropped EXE 15 IoCs

pid	Process
5036	SolaraBootstrapper.exe
3284	SolaraBootstrapper.exe
3200	SolaraBootstrapper.exe
4836	SolaraBootstrapper.exe
4512	SolaraBootstrapper.exe
1636	SolaraBootstrapper.exe
4624	SolaraBootstrapper.exe
1948	SolaraBootstrapper.exe
2220	SolaraBootstrapper.exe
4768	SolaraBootstrapper.exe
228	SolaraBootstrapper.exe
4888	SolaraBootstrapper.exe
3224	SolaraBootstrapper.exe
4880	SolaraBootstrapper.exe
3472	SolaraBootstrapper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
968	PING.EXE
4432	PING.EXE
1516	PING.EXE
1316	PING.EXE
760	PING.EXE
1668	PING.EXE
3764	PING.EXE
4660	PING.EXE
2728	PING.EXE
3548	PING.EXE
2168	PING.EXE
1576	PING.EXE
536	PING.EXE
3152	PING.EXE
1336	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
4660	PING.EXE
3152	PING.EXE
1516	PING.EXE
1316	PING.EXE
2728	PING.EXE
4432	PING.EXE
760	PING.EXE
2168	PING.EXE
1668	PING.EXE
968	PING.EXE
3548	PING.EXE
1336	PING.EXE
3764	PING.EXE
1576	PING.EXE
536	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4664	schtasks.exe
4352	schtasks.exe
3528	schtasks.exe
4728	schtasks.exe
1092	schtasks.exe
4152	schtasks.exe
4084	schtasks.exe
404	schtasks.exe
1808	schtasks.exe
760	schtasks.exe
4972	schtasks.exe
4520	schtasks.exe
4804	schtasks.exe
4300	schtasks.exe
1716	schtasks.exe
4508	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	SolaraBootstrapper.exe
Token: SeDebugPrivilege	5036	SolaraBootstrapper.exe
Token: SeDebugPrivilege	3284	SolaraBootstrapper.exe
Token: SeDebugPrivilege	3200	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4836	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4512	SolaraBootstrapper.exe
Token: SeDebugPrivilege	1636	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4624	SolaraBootstrapper.exe
Token: SeDebugPrivilege	1948	SolaraBootstrapper.exe
Token: SeDebugPrivilege	2220	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4768	SolaraBootstrapper.exe
Token: SeDebugPrivilege	228	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4888	SolaraBootstrapper.exe
Token: SeDebugPrivilege	3224	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4880	SolaraBootstrapper.exe
Token: SeDebugPrivilege	3472	SolaraBootstrapper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4728	4416	SolaraBootstrapper.exe	83
PID 4416 wrote to memory of 4728	4416	SolaraBootstrapper.exe	83
PID 4416 wrote to memory of 5036	4416	SolaraBootstrapper.exe	85
PID 4416 wrote to memory of 5036	4416	SolaraBootstrapper.exe	85
PID 5036 wrote to memory of 4804	5036	SolaraBootstrapper.exe	86
PID 5036 wrote to memory of 4804	5036	SolaraBootstrapper.exe	86
PID 5036 wrote to memory of 5052	5036	SolaraBootstrapper.exe	88
PID 5036 wrote to memory of 5052	5036	SolaraBootstrapper.exe	88
PID 5052 wrote to memory of 2364	5052	cmd.exe	90
PID 5052 wrote to memory of 2364	5052	cmd.exe	90
PID 5052 wrote to memory of 4660	5052	cmd.exe	91
PID 5052 wrote to memory of 4660	5052	cmd.exe	91
PID 5052 wrote to memory of 3284	5052	cmd.exe	99
PID 5052 wrote to memory of 3284	5052	cmd.exe	99
PID 3284 wrote to memory of 760	3284	SolaraBootstrapper.exe	100
PID 3284 wrote to memory of 760	3284	SolaraBootstrapper.exe	100
PID 3284 wrote to memory of 4508	3284	SolaraBootstrapper.exe	103
PID 3284 wrote to memory of 4508	3284	SolaraBootstrapper.exe	103
PID 4508 wrote to memory of 3280	4508	cmd.exe	105
PID 4508 wrote to memory of 3280	4508	cmd.exe	105
PID 4508 wrote to memory of 968	4508	cmd.exe	106
PID 4508 wrote to memory of 968	4508	cmd.exe	106
PID 4508 wrote to memory of 3200	4508	cmd.exe	114
PID 4508 wrote to memory of 3200	4508	cmd.exe	114
PID 3200 wrote to memory of 1092	3200	SolaraBootstrapper.exe	115
PID 3200 wrote to memory of 1092	3200	SolaraBootstrapper.exe	115
PID 3200 wrote to memory of 2636	3200	SolaraBootstrapper.exe	118
PID 3200 wrote to memory of 2636	3200	SolaraBootstrapper.exe	118
PID 2636 wrote to memory of 1540	2636	cmd.exe	120
PID 2636 wrote to memory of 1540	2636	cmd.exe	120
PID 2636 wrote to memory of 2728	2636	cmd.exe	121
PID 2636 wrote to memory of 2728	2636	cmd.exe	121
PID 2636 wrote to memory of 4836	2636	cmd.exe	125
PID 2636 wrote to memory of 4836	2636	cmd.exe	125
PID 4836 wrote to memory of 4300	4836	SolaraBootstrapper.exe	126
PID 4836 wrote to memory of 4300	4836	SolaraBootstrapper.exe	126
PID 4836 wrote to memory of 3276	4836	SolaraBootstrapper.exe	128
PID 4836 wrote to memory of 3276	4836	SolaraBootstrapper.exe	128
PID 3276 wrote to memory of 2220	3276	cmd.exe	131
PID 3276 wrote to memory of 2220	3276	cmd.exe	131
PID 3276 wrote to memory of 4432	3276	cmd.exe	132
PID 3276 wrote to memory of 4432	3276	cmd.exe	132
PID 3276 wrote to memory of 4512	3276	cmd.exe	135
PID 3276 wrote to memory of 4512	3276	cmd.exe	135
PID 4512 wrote to memory of 4664	4512	SolaraBootstrapper.exe	136
PID 4512 wrote to memory of 4664	4512	SolaraBootstrapper.exe	136
PID 4512 wrote to memory of 4720	4512	SolaraBootstrapper.exe	139
PID 4512 wrote to memory of 4720	4512	SolaraBootstrapper.exe	139
PID 4720 wrote to memory of 1808	4720	cmd.exe	141
PID 4720 wrote to memory of 1808	4720	cmd.exe	141
PID 4720 wrote to memory of 760	4720	cmd.exe	142
PID 4720 wrote to memory of 760	4720	cmd.exe	142
PID 4720 wrote to memory of 1636	4720	cmd.exe	144
PID 4720 wrote to memory of 1636	4720	cmd.exe	144
PID 1636 wrote to memory of 1716	1636	SolaraBootstrapper.exe	145
PID 1636 wrote to memory of 1716	1636	SolaraBootstrapper.exe	145
PID 1636 wrote to memory of 884	1636	SolaraBootstrapper.exe	148
PID 1636 wrote to memory of 884	1636	SolaraBootstrapper.exe	148
PID 884 wrote to memory of 4580	884	cmd.exe	150
PID 884 wrote to memory of 4580	884	cmd.exe	150
PID 884 wrote to memory of 3548	884	cmd.exe	151
PID 884 wrote to memory of 3548	884	cmd.exe	151
PID 884 wrote to memory of 4624	884	cmd.exe	153
PID 884 wrote to memory of 4624	884	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4728
- C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XkGc59a2diXd.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2364
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4660
  - - C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GiIWdDLz6tyr.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4508
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3280
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:968
      - C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CSIDQoMKfVXY.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1540
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2728
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RaQdG33BZzdN.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4432
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u5L6t8AcQtVA.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1808
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:760
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o7AlhRsggsVj.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3548
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4vlZ6w6UaY88.bat" "
        15⤵
        
        PID:2752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4832
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3152
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pL8lxOH9kAkZ.bat" "
        17⤵
        
        PID:436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1336
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LkMr9ezhRYyn.bat" "
        19⤵
        
        PID:4388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3276
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWuD6he2dvlk.bat" "
        21⤵
        
        PID:1876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1668
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MGM7YlyZPgEm.bat" "
        23⤵
        
        PID:3144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3764
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VayDTBW7bMrB.bat" "
        25⤵
        
        PID:4884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4868
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1576
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vkomp71iIdyg.bat" "
        27⤵
        
        PID:508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1340
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1516
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4880
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YV4lxC0mPVDv.bat" "
        29⤵
        
        PID:5036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:5064
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1316
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hVYhPyjS3g83.bat" "
        31⤵
        
        PID:1444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:4636
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SolaraBootstrapper.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\4vlZ6w6UaY88.bat

Filesize
219B

MD5
aa6f0304cfa8b4575da94fcd0962b927

SHA1
585b4993ed326299cecb79ccf930721fd104642e

SHA256
874a4d07dce18261c0cbdd029c2b069aeb4f361294881561491c2dfebc993651

SHA512
9959a7f8137dca6616050bd57fe3873ce3d36c393707e84e5e936c3b2fc15e8d9810a89f0211d9f701512da71c5a67baf0a1f21d49a54686e9d5d0a96f22be14

Download Submit
C:\Users\Admin\AppData\Local\Temp\CSIDQoMKfVXY.bat

Filesize
219B

MD5
dd2a324fd6c80ff3b6e176183d68dc0e

SHA1
abf712506ea02b7e1277c3e25711c75bb6b8bff4

SHA256
3662a53ce717d2f9cb2f71ec284c2d9df0fd776421c9774399050420a1df5a24

SHA512
5fdf55ae9987191e967e64e106d4f024b177849c9f1c43ba0305328afcc115cc42b312d225b073d7bd716f97f5d01e9cd3910cf56dcf40687ba0b0fdb6b0ea07

Download Submit
C:\Users\Admin\AppData\Local\Temp\GiIWdDLz6tyr.bat

Filesize
219B

MD5
b2bff75e983aa6a2149ff68d0610278c

SHA1
9422b0373884cdd1be17a5afe789692b27b3ca3c

SHA256
ef9519170c1cdc8b44e7b0024abd924bfab7a4df6c08d49678dfe1e827b4e763

SHA512
d3edf0174d7658f807f8aaf294393544a8d5a5f85e35f7bdb1778083fc5a0bad1f1aaa6dbade087cb79d129c552a600e275adbc4f0fffa0ffa753e4e7a8d0c49

Download Submit
C:\Users\Admin\AppData\Local\Temp\LkMr9ezhRYyn.bat

Filesize
219B

MD5
60a5a50dd817b1b11436d5517f07e7bb

SHA1
61dee89c578807bd22b03bf1d077032c715f3f30

SHA256
1ad3d805903e1d3cfeadba0fa47c9cb6fb0938ccb8d548bd622127e4c6ff3550

SHA512
620a85ac708c49a404c90edf9249a48eabdfa64ea0754d7c9ed30b56c20dc6f9710ef37103914b549032dabee25496bb7ed19b7e00a1c6156b77199222ad4fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\MGM7YlyZPgEm.bat

Filesize
219B

MD5
3c0e331a869934ed4f4bc0a46807c1c9

SHA1
0ea7a6479dc2104f92ecb6a293d127dd709b2abc

SHA256
4e0140d4a5cbd8368f68951b3b9a93f08738cf01e900f84fbe0fb9524b339abd

SHA512
47979644e2ea865f8cead14788e65eec76c53932c0999ed9975e7ffc275d9ee0167f911929e6219b63d88c1d15c4f2be0dbde6f6889cc0d93a0842fbb36b15d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RaQdG33BZzdN.bat

Filesize
219B

MD5
b2f4bb36247b503f17e6dcaf14695852

SHA1
3f14e52596d4b283812cd15f7a45f2f50311843b

SHA256
38922e721d3b6a4af8ffbc493774196f448429d654e06e4192316ca09d3fda70

SHA512
9822975a6dd9e8bbf6abf2a64a0206e9b65d7773987fc7c64c7b34296dc57c81a71f0ef706df7ef1b44211c25d7adc15384321b2767106c38c7255feec45bc7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\VayDTBW7bMrB.bat

Filesize
219B

MD5
951b569e50f04ddd10a36885449593da

SHA1
5ea570f8a3b844f2f79fb15f9db8b52131164191

SHA256
87918f93f7e5d791a032e0bb8328766ce8ee58bf765fa126d13dae3e72800615

SHA512
be9426156b97c767148fd7749bac78001f93333ae38f7f8acd5477e17a2e38ceb307086c8c83a800196bc16b1e3d1617cf099ac7a19689fd22430471d40b56bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkGc59a2diXd.bat

Filesize
219B

MD5
22e3e64fb3c6fa821a7b233b642ea6c7

SHA1
3a1fc5dfcdf3878084c1866e9b3f1654421a4d7d

SHA256
808a89809be0a45501fcd649568d0586ab63f60a000530f82e119f3b64c73113

SHA512
04b5610a2f2eda2aae91607d39731c8775c3dad8e239ad179ac4e708ed55a6e32659ac8f6c281ff2e70c4bb6c1b42c6a91e1d84b25160b4ed666da3a3aa199db

Download Submit
C:\Users\Admin\AppData\Local\Temp\YV4lxC0mPVDv.bat

Filesize
219B

MD5
703b40050f14c6c1c3aa43dfcf94ce62

SHA1
9dd3b15e2a9b6c0e60b76f04f362a6e6ec75fff0

SHA256
527c4f3b56f0f946414d93ed1253146f35c698f4e7dd13846677a2b55cd5160d

SHA512
323815b68ca1571f115b8b3b9f40ae5e114d9254cc9ca6b99d97d72fcefcb94262365ee7dfccf97ce6d2a7bce66ec8176a1b3fd91d05847dadc416e84f193939

Download Submit
C:\Users\Admin\AppData\Local\Temp\hVYhPyjS3g83.bat

Filesize
219B

MD5
98d234c24c2b87b963e94f194aa59eb0

SHA1
3a6058a7bdc44d2554add9d1d93ea5c566eb8731

SHA256
4f80124a619fce9ed56128a8790f2c8e1b8e9dd9e0d40e49df33a1260d107db3

SHA512
4b71ba4a738cd46993150f4eb91baa29925806ecabe135425c332e8268c9e39e42121ae1bcebf157a2d400a05a11b5a533b9149d1bc673e31f07de0176ad0956

Download Submit
C:\Users\Admin\AppData\Local\Temp\jWuD6he2dvlk.bat

Filesize
219B

MD5
9aa72de16c1b215fb0b6d2f1ba15b1cd

SHA1
5e66f3f3021225a938e59835163a6b3ffbd62592

SHA256
9990d8448cdb068eeaca7e481d764152ae635ff92cec5730fa46fed1d80e0d2f

SHA512
d0e00056d98400af1d7336e0af82d3f93e0fcecf814b011c45e6b49b4e1393d73e7283c03b0a3dcf98b947f8f6ae4069e76ce3af69cf22ea0935898d6e39be9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7AlhRsggsVj.bat

Filesize
219B

MD5
6720308be5519ca0b907e1d15d57e01c

SHA1
4804b59c1b9e39c5bfb64f83d484039bab3ae79a

SHA256
2f50f3fc1d89d09fa63dc41bd569d9faec65be96568ccf922d7212b7466753e6

SHA512
e4022278ba86a40edbc6c13c3e8683ab4bb336620eb879e4c8f56923de7d1f1cfe460d97b8d3200cb4bb6cf2254b1902a4c2dbdae4baa876bc0e443b01598d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pL8lxOH9kAkZ.bat

Filesize
219B

MD5
7d8a51f2a2172897a4e0546413048ee3

SHA1
77c66753e608ae3bb10bd620456d77450a71eef1

SHA256
60e346d1b8ab116c050b9d316d1ed0382288f9c63a2436e419b421351b83a97e

SHA512
a6fa3bfc78d0f9b4d804fde27e161e470d0734c1aa53508bd013af23eb232324c2292e3195c54c1c1e698480279068c538e2eef199fc340e3e481c9a059a8c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\u5L6t8AcQtVA.bat

Filesize
219B

MD5
14c7013d0f0c3bcba1b116abb860a07f

SHA1
aac4a9bf9bafeecd8e98ea6591f0b7cd411f183f

SHA256
1c5512fc0d4428fc0f4e22e18d5bb5221e6227f6ccae0b149a878730b4dc7422

SHA512
5ae82de7be3e85ef4b765cdf00f605d713752c355b7851e10b19352b79f8dd674a899bc0b93557f616800518068b06d5c3a0f3758c16f2aa8f8726e5f5b3bf70

Download Submit
C:\Users\Admin\AppData\Local\Temp\vkomp71iIdyg.bat

Filesize
219B

MD5
e34a10db7f3399d06f9d0fb607e33816

SHA1
e90efd778662fb93529e42f25bd36e4c8f6fe4c2

SHA256
f0d2ae09845ddb16ef937f90a62c61dfe58687fc72352896004bd57df2e7623b

SHA512
cd684fbc6263754b502bc6d69de3bd3e4f71621b8235a4dcbe21ac62fbd30058256dcfbfe212820bc32f2322281c27714dab31ef897f16c541ab6880b91eec45

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\SolaraBootstrapper.exe

Filesize
3.1MB

MD5
777ed5284b4e0d4305e912b99f618141

SHA1
87453944e39401ceec173a996f88a38af7d70eab

SHA256
af28db66812bd93b8680039d629844fa8821c0f205285051a50ed4a3bcc7623d

SHA512
d5d7e0c0174714b70c642ba4122f2b8f5b6b77fa5b3e291364688c02ddfc3c5c9a3fedd011985779d93a15d7ac018259d33aa1e011e5edca1bd29bf5961727ad

Download Submit
memory/4416-0-0x00007FF9A4C43000-0x00007FF9A4C45000-memory.dmp

Filesize
8KB

Download
memory/4416-10-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

Filesize
10.8MB

Download
memory/4416-2-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

Filesize
10.8MB

Download
memory/4416-1-0x0000000000B70000-0x0000000000E94000-memory.dmp

Filesize
3.1MB

Download
memory/5036-18-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

Filesize
10.8MB

Download
memory/5036-14-0x000000001BE90000-0x000000001BF42000-memory.dmp

Filesize
712KB

Download
memory/5036-13-0x000000001BD80000-0x000000001BDD0000-memory.dmp

Filesize
320KB

Download
memory/5036-12-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

Filesize
10.8MB

Download
memory/5036-11-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads