solar[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
solar.exe
Size 7.2MB
Sample260722-bharfshd23
SHA256 593a7007186918cbc1150461f151d2ac2365da479d26e4a087cc6ec45bfff09a
MD5 1aca8d05617c131e2040c0957385b143
SHA1 fdd330d6ad0c6ffcb1c6efb91db87cc1cc5d65ff
SHA512 3e278b4f4e9169279d9261a30a1024766ab48b55148450686054ac154a2a30f2220c07d5fb926f84fb4251f6f521702bcef0775838895463f69a90001967a53b
SSDEEP 196608:5pQwSvI/jcXUGET/YSFr4H0Ue3HFK6Ajkwr5sA6B:owEI/mm9Fge1AjkQYB
TLSH
T1317623BD2264336DC01EC8388437ED49F2B5642F53DAC5EEB6CF76C47B664209982B46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
solar.exe

File Explorer

solar.exe

.exe 7.2MB

solar.exe

IMPHASH 81c8ec22bc3a814ca4a521611d18fbb7
SHA256 593a7007186918cbc1150461f151d2ac2365da479d26e4a087cc6ec45bfff09a
MD5 1aca8d05617c131e2040c0957385b143
SHA1 fdd330d6ad0c6ffcb1c6efb91db87cc1cc5d65ff
SHA512 3e278b4f4e9169279d9261a30a1024766ab48b55148450686054ac154a2a30f2220c07d5fb926f84fb4251f6f521702bcef0775838895463f69a90001967a53b
SSDEEP 196608:5pQwSvI/jcXUGET/YSFr4H0Ue3HFK6Ajkwr5sA6B:owEI/mm9Fge1AjkQYB
TLSH
T1317623BD2264336DC01EC8388437ED49F2B5642F53DAC5EEB6CF76C47B664209982B46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

14513347

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpConnect

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

advapi32

SystemFunction036

psapi

GetModuleInformation

ws2_32

freeaddrinfo

kernel32

LoadLibraryExW FlsSetValue LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

FindWindowW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

GetStockObject

shell32

ShellExecuteA

ole32

CoCreateInstance

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

ntdll

ZwWriteVirtualMemory

dwmapi

DwmUnregisterThumbnail

imm32

ImmReleaseContext

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

winmm

timeBeginPeriod

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-math-l1-1-0

ldexp

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-string-l1-1-0

towlower

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw

api-ms-win-crt-filesystem-l1-1-0

_wstat64

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SetErrorInfo

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

907KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

solar.exe

winhttp

crypt32

wintrust

d3d11

d3dcompiler_47

advapi32

psapi

ws2_32

kernel32

user32

gdi32

shell32

ole32

msvcp140

ntdll

dwmapi

imm32

shlwapi

userenv

winmm

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

oleaut32

wtsapi32

generic