Analysis

  • max time kernel
    51s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 14:04

General

  • Target

    Bootstrapper.exe

  • Size

    800KB

  • MD5

    02c70d9d6696950c198db93b7f6a835e

  • SHA1

    30231a467a49cc37768eea0f55f4bea1cbfb48e2

  • SHA256

    8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

  • SHA512

    431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb

  • SSDEEP

    12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c ipconfig /all
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:3468
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
    • C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe
      "C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\ProgramData\Solara\Solara.exe
        "C:\ProgramData\Solara\Solara.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Solara\Newtonsoft.Json.dll

    Filesize

    695KB

    MD5

    195ffb7167db3219b217c4fd439eedd6

    SHA1

    1e76e6099570ede620b76ed47cf8d03a936d49f8

    SHA256

    e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    SHA512

    56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

  • C:\ProgramData\Solara\Solara.exe

    Filesize

    133KB

    MD5

    c6f770cbb24248537558c1f06f7ff855

    SHA1

    fdc2aaae292c32a58ea4d9974a31ece26628fdd7

    SHA256

    d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

    SHA512

    cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

  • C:\ProgramData\Solara\Wpf.Ui.dll

    Filesize

    5.2MB

    MD5

    aead90ab96e2853f59be27c4ec1e4853

    SHA1

    43cdedde26488d3209e17efff9a51e1f944eb35f

    SHA256

    46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

    SHA512

    f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

  • C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe

    Filesize

    2.8MB

    MD5

    be4da425d9b7593e358ffbfca29f9c70

    SHA1

    dc98530aad9728d779866ae957a738c52b13a565

    SHA256

    c5277ddb6e51181d2b8bad59acf5f2badf5613b1e73384a84b793f720aa76c0d

    SHA512

    35790944f5855038f8357c0f6d11ea81b260632e590c26f9342e8beb1a8dfd2e3eb9efa11f8378f8542cad45e7675af3d29cf27424accf35aaa6aeb34487155b

  • memory/3256-461-0x00000164FB620000-0x00000164FB6D2000-memory.dmp

    Filesize

    712KB

  • memory/3256-456-0x00000164DFF80000-0x00000164DFFA4000-memory.dmp

    Filesize

    144KB

  • memory/3256-458-0x00000164FBAA0000-0x00000164FBFDC000-memory.dmp

    Filesize

    5.2MB

  • memory/3256-459-0x00000164FB560000-0x00000164FB61A000-memory.dmp

    Filesize

    744KB

  • memory/3532-5-0x000001CA34E60000-0x000001CA34E82000-memory.dmp

    Filesize

    136KB

  • memory/3532-20-0x00007FFE0C910000-0x00007FFE0D3D1000-memory.dmp

    Filesize

    10.8MB

  • memory/3532-19-0x000001CA4F840000-0x000001CA4F942000-memory.dmp

    Filesize

    1.0MB

  • memory/3532-6-0x000001CA4F840000-0x000001CA4F942000-memory.dmp

    Filesize

    1.0MB

  • memory/3532-0-0x00007FFE0C913000-0x00007FFE0C915000-memory.dmp

    Filesize

    8KB

  • memory/3532-4-0x00007FFE0C913000-0x00007FFE0C915000-memory.dmp

    Filesize

    8KB

  • memory/3532-2-0x00007FFE0C910000-0x00007FFE0D3D1000-memory.dmp

    Filesize

    10.8MB

  • memory/3532-1-0x000001CA33000000-0x000001CA330CE000-memory.dmp

    Filesize

    824KB

  • memory/3944-29-0x00000133A5570000-0x00000133A5578000-memory.dmp

    Filesize

    32KB

  • memory/3944-40-0x00000133F2880000-0x00000133F2892000-memory.dmp

    Filesize

    72KB

  • memory/3944-28-0x00000133A5530000-0x00000133A5558000-memory.dmp

    Filesize

    160KB

  • memory/3944-31-0x00000133A5560000-0x00000133A556A000-memory.dmp

    Filesize

    40KB

  • memory/3944-32-0x00000133A54E0000-0x00000133A54EA000-memory.dmp

    Filesize

    40KB

  • memory/3944-33-0x00000133A5CB0000-0x00000133A5CB8000-memory.dmp

    Filesize

    32KB

  • memory/3944-35-0x00000133F2600000-0x00000133F26B2000-memory.dmp

    Filesize

    712KB

  • memory/3944-37-0x00000133F27F0000-0x00000133F280E000-memory.dmp

    Filesize

    120KB

  • memory/3944-38-0x00000133F2810000-0x00000133F281A000-memory.dmp

    Filesize

    40KB

  • memory/3944-30-0x00000133A5C80000-0x00000133A5C96000-memory.dmp

    Filesize

    88KB

  • memory/3944-27-0x00000133A54D0000-0x00000133A54DA000-memory.dmp

    Filesize

    40KB

  • memory/3944-26-0x00000133A5B80000-0x00000133A5C80000-memory.dmp

    Filesize

    1024KB

  • memory/3944-24-0x00000133A54F0000-0x00000133A5528000-memory.dmp

    Filesize

    224KB

  • memory/3944-25-0x00000133A54C0000-0x00000133A54CE000-memory.dmp

    Filesize

    56KB

  • memory/3944-23-0x00000133A5470000-0x00000133A5478000-memory.dmp

    Filesize

    32KB

  • memory/3944-22-0x0000013386540000-0x0000013386550000-memory.dmp

    Filesize

    64KB

  • memory/3944-21-0x0000013385C70000-0x0000013385F4A000-memory.dmp

    Filesize

    2.9MB