Resubmissions
24-12-2024 04:30
241224-e5bh2s1ngs 824-12-2024 04:24
241224-e1k7pa1ndw 824-12-2024 04:20
241224-eycsja1nbv 8Analysis
-
max time kernel
91s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 04:30
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper (2).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bootstrapper (2).exe
Resource
win10v2004-20241007-en
General
-
Target
Bootstrapper (2).exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Bootstrapper (2).exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation BootstrapperV2.04.exe -
Executes dropped EXE 2 IoCs
pid Process 756 BootstrapperV2.04.exe 4416 Solara.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 55 pastebin.com 56 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4536 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4416 Solara.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 748 WMIC.exe Token: SeSecurityPrivilege 748 WMIC.exe Token: SeTakeOwnershipPrivilege 748 WMIC.exe Token: SeLoadDriverPrivilege 748 WMIC.exe Token: SeSystemProfilePrivilege 748 WMIC.exe Token: SeSystemtimePrivilege 748 WMIC.exe Token: SeProfSingleProcessPrivilege 748 WMIC.exe Token: SeIncBasePriorityPrivilege 748 WMIC.exe Token: SeCreatePagefilePrivilege 748 WMIC.exe Token: SeBackupPrivilege 748 WMIC.exe Token: SeRestorePrivilege 748 WMIC.exe Token: SeShutdownPrivilege 748 WMIC.exe Token: SeDebugPrivilege 748 WMIC.exe Token: SeSystemEnvironmentPrivilege 748 WMIC.exe Token: SeRemoteShutdownPrivilege 748 WMIC.exe Token: SeUndockPrivilege 748 WMIC.exe Token: SeManageVolumePrivilege 748 WMIC.exe Token: 33 748 WMIC.exe Token: 34 748 WMIC.exe Token: 35 748 WMIC.exe Token: 36 748 WMIC.exe Token: SeIncreaseQuotaPrivilege 748 WMIC.exe Token: SeSecurityPrivilege 748 WMIC.exe Token: SeTakeOwnershipPrivilege 748 WMIC.exe Token: SeLoadDriverPrivilege 748 WMIC.exe Token: SeSystemProfilePrivilege 748 WMIC.exe Token: SeSystemtimePrivilege 748 WMIC.exe Token: SeProfSingleProcessPrivilege 748 WMIC.exe Token: SeIncBasePriorityPrivilege 748 WMIC.exe Token: SeCreatePagefilePrivilege 748 WMIC.exe Token: SeBackupPrivilege 748 WMIC.exe Token: SeRestorePrivilege 748 WMIC.exe Token: SeShutdownPrivilege 748 WMIC.exe Token: SeDebugPrivilege 748 WMIC.exe Token: SeSystemEnvironmentPrivilege 748 WMIC.exe Token: SeRemoteShutdownPrivilege 748 WMIC.exe Token: SeUndockPrivilege 748 WMIC.exe Token: SeManageVolumePrivilege 748 WMIC.exe Token: 33 748 WMIC.exe Token: 34 748 WMIC.exe Token: 35 748 WMIC.exe Token: 36 748 WMIC.exe Token: SeDebugPrivilege 2144 Bootstrapper (2).exe Token: SeDebugPrivilege 756 BootstrapperV2.04.exe Token: SeDebugPrivilege 4416 Solara.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2144 wrote to memory of 3632 2144 Bootstrapper (2).exe 84 PID 2144 wrote to memory of 3632 2144 Bootstrapper (2).exe 84 PID 3632 wrote to memory of 4536 3632 cmd.exe 86 PID 3632 wrote to memory of 4536 3632 cmd.exe 86 PID 2144 wrote to memory of 3832 2144 Bootstrapper (2).exe 87 PID 2144 wrote to memory of 3832 2144 Bootstrapper (2).exe 87 PID 3832 wrote to memory of 748 3832 cmd.exe 89 PID 3832 wrote to memory of 748 3832 cmd.exe 89 PID 2144 wrote to memory of 756 2144 Bootstrapper (2).exe 98 PID 2144 wrote to memory of 756 2144 Bootstrapper (2).exe 98 PID 756 wrote to memory of 4416 756 BootstrapperV2.04.exe 110 PID 756 wrote to memory of 4416 756 BootstrapperV2.04.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper (2).exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper (2).exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4536
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper (2).exe" --isUpdate true2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
133KB
MD5c6f770cbb24248537558c1f06f7ff855
SHA1fdc2aaae292c32a58ea4d9974a31ece26628fdd7
SHA256d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b
SHA512cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
2.8MB
MD5be4da425d9b7593e358ffbfca29f9c70
SHA1dc98530aad9728d779866ae957a738c52b13a565
SHA256c5277ddb6e51181d2b8bad59acf5f2badf5613b1e73384a84b793f720aa76c0d
SHA51235790944f5855038f8357c0f6d11ea81b260632e590c26f9342e8beb1a8dfd2e3eb9efa11f8378f8542cad45e7675af3d29cf27424accf35aaa6aeb34487155b