Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 20:29

General

  • Target
    SolaraV3 (1).exe
  • Size 18.4MB
  • Sample260916-y9lpcsvglh
  • SHA256 f07e7c06d1a66307bc38a5b50c3b2a2308ebdbfbb2edcc8132678e0735b6ba99
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Loads dropped DLL 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraV3 (1).exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraV3 (1).exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5804
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="SolaraV3 (1).exe" --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5804.3592.9326072430340424937 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x164,0x194,0x7ff945865fd8,0x7ff945865fe4,0x7ff945865ff0
        3⤵
          PID:3444
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name="SolaraV3 (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1716,i,10869527810270932807,228175174894194789,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
          3⤵
            PID:1524
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name="SolaraV3 (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1716,i,10869527810270932807,228175174894194789,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
            3⤵
              PID:1636
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name="SolaraV3 (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1716,i,10869527810270932807,228175174894194789,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
              3⤵
                PID:5220
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name="SolaraV3 (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1716,i,10869527810270932807,228175174894194789,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
                3⤵
                  PID:616
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name="SolaraV3 (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4328 --field-trial-handle=1716,i,10869527810270932807,228175174894194789,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
                  3⤵
                    PID:1812

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    DEBUG.txt

                    • Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
                    • Size 206B
                    • SHA256 5d66dc699ceafea37c84d5430cec9e724131266f5da7806dfb551d130171c085
                    • MD5 SHA1 SHA512 TLSH

                    UIDEBUG.txt

                    • Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
                    • Size 1KB
                    • SHA256 c61b6906fbb28e4034751bb1097e02e400d861ef61ab9a3454b2126c488263ae
                    • MD5 SHA1 SHA512 TLSH

                    UIDEBUG.txt

                    • Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
                    • Size 4KB
                    • SHA256 2c48ada0c8618af02530654c57e520b925b642c5b93c762ecf82b6a21ec0af51
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    SolaraV3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
                    • Size 14.5MB
                    • SHA256 8d89f996e2838c26b15c76b8e34089196ce538273d541279c90cc2798c7723c7
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    settings.dat

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 47abd584698b25140dcc5ccb697f23d1e8165de57c3f2ae60246b75d34dba32e
                    • MD5 SHA1 SHA512 TLSH

                    settings.dat

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 60fe33205ffd6c025b34d7021cdc37852731996c4a1c6b6dfc3c174988dfa44a
                    • MD5 SHA1 SHA512

                    throttle_store.dat

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
                    • Size 20B
                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                    • MD5 SHA1 SHA512

                    3c33a95c-694a-46af-a8b2-c5e819e37d67.tmp

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\3c33a95c-694a-46af-a8b2-c5e819e37d67.tmp
                    • Size 6KB
                    • SHA256 4d622412e38167b61e9c830dcdc7cd1394192ae07d5a2265b45011ace89b84ee
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    the-real-index

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                    • Size 240B
                    • SHA256 2c4d84ffc16782d858f915d71b5b0b947ed67886bcd48e8662c11b46fd9dd283
                    • MD5 SHA1 SHA512 TLSH

                    the-real-index~RFe59c2ba.TMP

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c2ba.TMP
                    • Size 48B
                    • SHA256 37fced3d87e213285b98eced5518a591beda56937d984401d233c27d418eae1d
                    • MD5 SHA1 SHA512

                    Network Persistent State

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
                    • Size 1KB
                    • SHA256 48f8faf0d2fafe381e85c22cfd39bdbf9769697c0ece023938fe68afaa8434b3
                    • MD5 SHA1 SHA512 TLSH

                    Network Persistent State~RFe5a7d40.TMP

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe5a7d40.TMP
                    • Size 59B
                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                    • MD5 SHA1 SHA512 TLSH

                    SCT Auditing Pending Reports

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
                    • Size 2B
                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                    • MD5 SHA1 SHA512

                    Preferences

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
                    • Size 6KB
                    • SHA256 eff81279822b01058e91f48e249c045df24ffbe86532bf8be0f646a67c850d3d
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    CURRENT

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\shared_proto_db\metadata\CURRENT
                    • Size 16B
                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                    • MD5 SHA1 SHA512

                    MANIFEST-000001

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                    • Size 41B
                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                    • MD5 SHA1 SHA512

                    data_0

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_0
                    • Size 8KB
                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                    • MD5 SHA1 SHA512 SSDEEP

                    data_1

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_1
                    • Size 264KB
                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                    • MD5 SHA1 SHA512 SSDEEP

                    data_2

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_2
                    • Size 8KB
                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                    • MD5 SHA1 SHA512 SSDEEP

                    data_3

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_3
                    • Size 8KB
                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                    • MD5 SHA1 SHA512 SSDEEP

                    Local State

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
                    • Size 2KB
                    • SHA256 d68201661df04bf04825dc7b6d3c22e4a39a79457a5713c772145531d9d35bf8
                    • MD5 SHA1 SHA512 TLSH

                    Local State

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
                    • Size 3KB
                    • SHA256 56de20e71b61bbf1398214e5f7b1683040c69a26ceb47c52f884aae5b8150091
                    • MD5 SHA1 SHA512 TLSH

                    Local State

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
                    • Size 16KB
                    • SHA256 f985b4a7a376b4557ecc3853b42c800fad6a49b5a8a1ac7e1b7bca2126d02088
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    Local State~RFe59555a.TMP

                    • Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe59555a.TMP
                    • Size 1KB
                    • SHA256 7bec1d690a7408abdb33b5d9113612fc8c5c22e2fa541761274142cef28b24c6
                    • MD5 SHA1 SHA512 TLSH

                    memory/616-321-0x000001F2417C0000-0x000001F241872000-memory.dmp

                    memory/616-94-0x00007FF9663A0000-0x00007FF9663A1000-memory.dmp

                    memory/1524-320-0x0000021C8AD50000-0x0000021C8AE02000-memory.dmp

                    memory/1524-426-0x0000021C8AD50000-0x0000021C8AE02000-memory.dmp

                    memory/1524-48-0x00007FF9663A0000-0x00007FF9663A1000-memory.dmp

                    memory/1812-402-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/1812-404-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/1812-408-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/1812-409-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/1812-413-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/1812-411-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/1812-410-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/1812-412-0x00000268DEF80000-0x00000268DEF81000-memory.dmp

                    memory/5804-386-0x00007FF941DE0000-0x00007FF942C6A000-memory.dmp

                    memory/5804-271-0x00007FF941DE0000-0x00007FF942C6A000-memory.dmp