Analysis
-
max time kernel
420s -
max time network
598s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
29/03/2025, 19:13
General
-
Target
SOLARA.exe
-
Size
3.1MB
-
MD5
1e4e8c6d1bf62ff6b365e0cba9c4a6d1
-
SHA1
2acf897c8414528b0620707c8661d268af0d1222
-
SHA256
19f8b2f1c0fffe8f37dee7acb107554034f73af09de178fcee107a04cb6ea98e
-
SHA512
4f537099eacd68f3c825cfb5501f2082c3b43b7e3cdff9755765d9a3b9285cbfadd8374df79c78963404c7c51866eb324482cd0b32e965c121c3beb2736c935c
-
SSDEEP
49152:AbESTJiIxUpG75B8+8eX2LDIuNWBqBhrh4YPaNvq7EBHgFD82/mc1tQhR5IsaS6m:Ab5TY1G75/IQBq146aRBHgsmsaxGV
Malware Config
Signatures
-
Detect SalatStealer payload 31 IoCs
-
Salatstealer family
-
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOLARA.exe"C:\Users\Admin\AppData\Local\Temp\SOLARA.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Multimedia Platform\taskhostw.exe"C:\Program Files (x86)\Windows Multimedia Platform\taskhostw.exe"2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD51e4e8c6d1bf62ff6b365e0cba9c4a6d1
SHA12acf897c8414528b0620707c8661d268af0d1222
SHA25619f8b2f1c0fffe8f37dee7acb107554034f73af09de178fcee107a04cb6ea98e
SHA5124f537099eacd68f3c825cfb5501f2082c3b43b7e3cdff9755765d9a3b9285cbfadd8374df79c78963404c7c51866eb324482cd0b32e965c121c3beb2736c935c
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB