Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/09/2026, 12:33
General
- Target 1.exe
- Size 55KB
- Sample260925-prdrcseb45
- SHA256 a6a1598cd6713d7afbfc6d48427dd986154aa724215549477f190d10ee15bfe2
Malware Config
Extracted
-
solaris_loader
-
drpnew
-
193.178.158.107
-
192.162.199.186
-
62.60.226.232
Signatures
- Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gckhi8q0.exe
r8qk9ce2.exe
wlrmdr.exe
memory/3004-3-0x000001BE0A180000-0x000001BE0A182000-memory.dmp
memory/3320-12-0x0000000180000000-0x0000000180005000-memory.dmp
memory/3320-19-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/3320-24-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-26-0x0000000002190000-0x00000000021A0000-memory.dmp
memory/3320-25-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-27-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-28-0x00007FF85CA72000-0x00007FF85CA73000-memory.dmp
memory/3320-29-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-30-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-35-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-34-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-37-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-33-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-32-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-31-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-36-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-44-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-43-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-42-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-41-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-40-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-39-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-38-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-47-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-50-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-49-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-48-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-46-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-45-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-52-0x0000000002190000-0x00000000021A0000-memory.dmp
memory/3320-51-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-54-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-53-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-56-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-55-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-57-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-60-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-59-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-58-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-62-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-61-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-63-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-64-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-65-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-67-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-71-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-70-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-72-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-69-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-68-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-66-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-74-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-75-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-73-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-76-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-77-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-78-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-79-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-80-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-81-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-82-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-83-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-85-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-84-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-86-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-89-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-90-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-88-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-87-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-91-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-92-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-93-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-98-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-97-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-96-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-95-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-94-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-99-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-100-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-101-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-102-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-103-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-104-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-105-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-106-0x00007FF85C9D0000-0x00007FF85CAD7000-memory.dmp
memory/3320-114-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-115-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-116-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-117-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-119-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-118-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-120-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-121-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-125-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-124-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-122-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-123-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-127-0x0000000002170000-0x0000000002180000-memory.dmp
memory/3320-126-0x0000000002170000-0x0000000002180000-memory.dmp