Analysis
- user interaction
yes - max time kernel
7s - max time network
12s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
SolaraV3.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
SolaraV3.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
General
- Target SolaraV3.exe
- Size 18.3MB
- Sample260811-2mrtmszyct
- SHA256 fe8d032fde42038d8f37d1a93134fe1a2105a0e80259555fd9578ac4f7986666
- MD5 03eb0a1f8f30c124509e8a517c9c6999
- SHA1 ec9ff3c15ab6b7822155641ca79cf9d6c6c758d8
- SHA512 896392fc461aa5433bbf4d0ff0b0388bb0fb725c115a22945c36d25598cacfa52cb9c8fc7176d7c6815753af4c16eb9ce183d30ad963c842e9f16d1da863309d
- SSDEEP 393216:ItXdJBvGlmAzKCUqhqJmY1ypQ4d4SAIsdZz:QXdJBvGlmAzKCUqhqJmY1ypOKe5
- TLSH T11317E7617B5B99ACD09BC47483478A720A7170CB0B35B9FF449496382F6EBF42F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 12 1912 SolaraV3.exe 12 1912 SolaraV3.exe - Loads dropped DLL 1 IoCs
pid Process 1912 SolaraV3.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SolaraV3.exe - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x00080000000244f1-237.dat embeds_openssl - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5084 msedgewebview2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1912 SolaraV3.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1912 wrote to memory of 5084 1912 SolaraV3.exe 85 PID 5084 wrote to memory of 332 5084 msedgewebview2.exe 86 PID 5084 wrote to memory of 4168 5084 msedgewebview2.exe 87 PID 5084 wrote to memory of 4168 5084 msedgewebview2.exe 87 PID 5084 wrote to memory of 4168 5084 msedgewebview2.exe 87 PID 5084 wrote to memory of 1064 5084 msedgewebview2.exe 88 PID 5084 wrote to memory of 3088 5084 msedgewebview2.exe 89 PID 5084 wrote to memory of 3088 5084 msedgewebview2.exe 89 PID 5084 wrote to memory of 2448 5084 msedgewebview2.exe 90 PID 5084 wrote to memory of 2448 5084 msedgewebview2.exe 90 PID 5084 wrote to memory of 2448 5084 msedgewebview2.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1912.2292.55547184095605230342⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffc705db078,0x7ffc705db084,0x7ffc705db0903⤵PID:332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,443423904769790291,151957596664877398,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:23⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,443423904769790291,151957596664877398,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:33⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,443423904769790291,151957596664877398,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:83⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,443423904769790291,151957596664877398,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:13⤵PID:2448
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
- Size 206B
- SHA256 e0b124b10becf629bed38eb396fa5e9a0d3890c937970cf7a863b651956c0395
- MD5 2dfcfb5ed4c630b02075adac26bf9793
- SHA1 6c7c78f7883b24a3a4069609595f330d2077b855
- SHA512 e96679b917e8fd8881c86722f3e942e039732be0fc1a9434035185f0b75f5289efc6faad027cdaecdfdac3c00a9f5489d2ed3e07af09918103838394be4ce4b4
- TLSH T147D0E915E6FCA8A26EBB654669782FD15785B4C304680EDC2B7B45077494C190E9F80A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
- Size 592B
- SHA256 4bb3984e5fcef13622be0c958659d16f799dee8cf8aae1c0f2caedfb6511adc5
- MD5 a0e208eeb2382f8e3777a8cd3143bfe4
- SHA1 290854cf0e62c2bad09fa74852f6ce2b2b9ae2c0
- SHA512 5912ca5a50fd7527f5a0f5711080781e2facade8ff95aa0cce7e7d244f1e16be2c1024d34e0b4b82843ce7030dadad688d8431e6919041fbf84cbef249ec7152
- TLSH T11CF090B4DEF9512F2D2B5099847B5EC680807197AE7A5FC81E33595035CA81EDD1362C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
- Size 1KB
- SHA256 4cbc7977697d92e32165a808e0acddde68162a79bce38abac2ed2bfc2d72172f
- MD5 88a773feb095d034c4d4ca62c475e006
- SHA1 36540f4d32ad4d7c47105f70ab0c6a3ac093a81c
- SHA512 03e7c9ad5036304ddfcb42129a4a191e542f329e63a42e0e408866756afcfad339210575ee8b1010dc3c7b9473b9fa31ee67de0da15f1847202b45a6782c50a1
- TLSH T130316C11DEF9D62B1CA5614EC47A0FE78455308F7A784BCD9FB2404576E2C089C2793E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
- Size 2KB
- SHA256 980d1cbac11d8a87bf7285ba1b874e23a520f1e31d822dfc7426b81753d4f64e
- MD5 2b88e3d71b23f1879900cace53be5ae3
- SHA1 d55f01987db217fce95fb58df78de2a9ad9ac485
- SHA512 18e0a6ecdd3589cf314bacc304c2d3bd232fb5aa709dbd11b826e2aecad1bbe3a89475d92e8f78fabec9e8b928f4d1807720c86a6e5400cdb7bebb496f90e11e
- TLSH T1A5516611DEFAD12B1CA6604ED46A0FE78459348F6B744BCCAF724009B1E2C0CAD2763A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
- Size 14.1MB
- SHA256 8f46931dc2c8927f9479bd34bf36e548111e3d4ffb0b84a6c469b00a6ff9b59b
- MD5 16e371fa13a86eee48566bc347a4ca75
- SHA1 569ae0977928cd9318b21cd050d57343f5c7e70e
- SHA512 ed94b76213d5fce09df707acca9754612644055a05ab1d302ab6585e05de973936aa69cb5fb776155faa4700f8829dcf77d82c9f50d93ea77437a0adccbdf928
- SSDEEP 393216:tkW8VlYoU9A7toJ+70io6wGYm5jkeXIUC5:t5Smuo1
- TLSH T1CBE69EE621D910ACC56AC5B9C343EA3BC76F74390335D6E75270A6621E23ED1367AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 a4ac324a2e94cfcddfde96dcc2ac3b4d1fc65220d7bfe02d31c97376ae8ddf9d
- MD5 e0af3c6b187a56ca194e27d7477984cb
- SHA1 e698933abd413c861376e91f549450ac7a18560e
- SHA512 500def5338b293ba99555d85f8ede193bbb9e659142e9dcc4c7ba59b251fcf0ee97ed2b1247a064efd4b5ef05f3983b188303b74f06cc44f95ef70e5039463e6
- TLSH T161D0121233120174C41020731066A2090640C60FA10940055828D61D1E084500907441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 1f6ca0e9b5bfd35454cd6f75dc3d8e8fdd2de2dd95247dc819f1824e006e5387
- MD5 a78be89a7735ab5aae48d11b705eb890
- SHA1 19c21ed61a8ebfb324ea5755915bfbd7c687059c
- SHA512 9d74fed4d8c2cd5e373af7071f9c43e258fb8ad579f72a7c3727aed3b33ee54d63e8e9b128c8bc99196189f9a73b856ec16d8248abb5adad275c522dbda41700
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
- Size 1KB
- SHA256 56958f3cc5abd0f00444e068b8b180ee45b2b8981d059a846e8af99d89a69ba6
- MD5 e4c80f3710eb20f3052e3f6184192658
- SHA1 926af698170080d2ed3fd3ec2471068de11d86d6
- SHA512 9767b3e984dd9cb6ebefc80f2d1b769a65617243884f8046b7b6bff1a8ba7df14b38ad6e1038de00f11f6b23f584a922a977f98c208de3091881f03fc6e529ec
- TLSH T13D318773D8943E37EC81A14AB2437F477D21502691919E58D5DE271802DB1DD5A3FD33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
- Size 2KB
- SHA256 5a2983d6ce4dbab803b4082f7d83c38924a012edb7c70b757285c9c243c6dfc8
- MD5 e0e86d9e6e0ba48762bcee1915c6306a
- SHA1 69e69cc1eee3a4f63f41b762bb09f004cd6b0570
- SHA512 d5e37c4f9b3c6539345f2fcb84be89114e64836b98ba61d19d05ea3dd03d4d002767d6f0b1c30d53a34107c8160f2cbd00ea22ef882f97bbbe16fbfadba135e1
- TLSH T17F51A733AC446E3BC8E39558B9463F13ED31906695A27FA0DADE2B1C01DB59C2707C23
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
- Size 3KB
- SHA256 1fcbc5bc5df2de64369a642d55564902935af285cd9719ee42738b78629159c9
- MD5 700405cb6afdf88f755b8555111090c2
- SHA1 81c294ccec1f81e981f4ddc18271a4cd69763c8e
- SHA512 ac311cb819ad49a2ec56713c145489952a01aa1d61b6839556f53b41e9b6b95d156382811628f1e14aa03cdbb898d1918368c8df9b5294028cf6e4e285a75ba6
- TLSH T1D971A736A9A4A93B8DE39949B8862F06BA619127E5D57FA4D9ED1F0C01DB2D81303C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe58b84f.TMP
- Size 1KB
- SHA256 915862e1d6f7c2764d50cf1253fce34475f2379e9d4d0c8a48ddd034f31b3e07
- MD5 9401838c01b9d245fd957cccca9c0ef3
- SHA1 8c6833355ca4bc65ecae59ba609d95fbfb0506a9
- SHA512 2ec8dc26de1977bb8fa5909c731c57104b54cd9054c810106b3129993415a823e8948b6ccd69a577f015906bc4979127731fdf0c98aa77337dd758202240dd55
- TLSH T1A4216573C8943D7AE881955AF203BF473D10906691A0AF28D5DE231802DB1ED9A3FD33
- MD5 SHA1 SHA512 TLSH