solaris_loader | 092664e3e946cedc4712f58d40294362aee1e5330c4d15c9f0d6303ae474bb5f

General

Target
0a844b9203ac2602_bot_x64.exe
Size 57KB
Sample261005-arlpmsty8q
SHA256 092664e3e946cedc4712f58d40294362aee1e5330c4d15c9f0d6303ae474bb5f
MD5 982d08d24b2f5793fe9ad55845226b5e
SHA1 5edb0658b69651b9d88f94aceb73afc4afde762c
SHA512 671eb3cac7813217921f23e16a5f04f1f85044d419613486362e5a95c48128cf1382fb1a828a36f2c8fbf9678307b6069c02623b62ef0e15e551946592af505f
SSDEEP 1536:2/ZQvFQ4NOs6xHRkni1/ANsdbkPt6+/2ITqAp4YL3N8di:OQvFlr6xHRkL+dbYgmZJEi
TLSH
T108430A3593974361CF628134D9B83327DAFDB9C57560512FC33CD918AEA32A2AE1C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery solaris_loader loader persistence privilege_escalation

Malware Config

Extracted

Family

solaris_loader

Version

PIRATE

C2

193.178.158.57
193.178.158.107
196.251.107.186

Signatures

Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	0a844b9203ac2602_bot_x64.exe

Executes dropped EXE 1 IoCs

pid	Process
4672	wlrmdr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0a844b9203ac2602_bot_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0a844b9203ac2602_bot_x64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4488	0a844b9203ac2602_bot_x64.exe
4488	0a844b9203ac2602_bot_x64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3292	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3292	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2632	4488	0a844b9203ac2602_bot_x64.exe	51
PID 4488 wrote to memory of 3292	4488	0a844b9203ac2602_bot_x64.exe	56
PID 4488 wrote to memory of 3760	4488	0a844b9203ac2602_bot_x64.exe	60
PID 4488 wrote to memory of 4084	4488	0a844b9203ac2602_bot_x64.exe	62
PID 4488 wrote to memory of 4616	4488	0a844b9203ac2602_bot_x64.exe	65
PID 3292 wrote to memory of 4540	3292	Explorer.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Local\Temp\0a844b9203ac2602_bot_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\0a844b9203ac2602_bot_x64.exe"
  2⤵
  - Checks computer location settings
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4616

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

1

T1055

Process Hollowing

1

T1055.012

Defense Evasion

Process Injection

1

T1055

Process Hollowing

1

T1055.012

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40ftgwcm.exe

Path C:\Users\Admin\AppData\Local\Temp\40ftgwcm.exe
Size 35KB
SHA256 5e8ad10a97578438492eefe0542623744a3df31d8159638ca02bc368d4edb800
MD5 461a234dce20055abac400ef5a6c730e
SHA1 eacece637173f604ef1ed96e26412d05e9bf7c7a
SHA512 621c75f4e38d4421a2599b73918da0961576d9610f46fd0c6f28e11e44413c12b8f8cb36bfe813355206a93c6a2beee521dbef8273924e77d8a585b5e30d706f
SSDEEP 768:1qDHhJ9MUBV8rGbkjOqEUhVSuWjXhKsuPgVDXi8cjnA1GRTc0uhC:EDHhvVV8yuOqjLWjXpuPgxcjnA6
TLSH
T156F2F75867F411B8FA13F23DD693D42BE691F06AA3E8D9DB073186611F73AE22030754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m01eus9y.exe

Path C:\Users\Admin\AppData\Local\Temp\m01eus9y.exe
Size 35KB
SHA256 410c69aa606f28095bf4f2e74dfadc19d01838c92b8d9190665f1e6dff59dc88
MD5 80adefa8ce85f2b207e2891fa22af477
SHA1 82c9ac9bdcff2d8ebc3c9228de5f89f4e39d811f
SHA512 b7876a2abd6dda1c8830ac134c6f50bb2bd7c41b8026e492e4993341969d50ef78cd65e7e2cf91aa20c4dd32d8331414f32a494fb2e9f32b89022ea7fd75c0e7
SSDEEP 768:RqRavh9V37o7t8jJLyFaKPjIr3HTq5XpT8nUw4O:RfvPV37o7SlLMb4UXl8nUg
TLSH
T1A4F2079AAFD70FE6C45614B8D296ECDAC87F76093234809A972B1431DF3D865763CD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlrmdr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
Size 57KB
SHA256 092664e3e946cedc4712f58d40294362aee1e5330c4d15c9f0d6303ae474bb5f
MD5 982d08d24b2f5793fe9ad55845226b5e
SHA1 5edb0658b69651b9d88f94aceb73afc4afde762c
SHA512 671eb3cac7813217921f23e16a5f04f1f85044d419613486362e5a95c48128cf1382fb1a828a36f2c8fbf9678307b6069c02623b62ef0e15e551946592af505f
SSDEEP 1536:2/ZQvFQ4NOs6xHRkni1/ANsdbkPt6+/2ITqAp4YL3N8di:OQvFlr6xHRkL+dbYgmZJEi
TLSH
T108430A3593974361CF628134D9B83327DAFDB9C57560512FC33CD918AEA32A2AE1C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2632-3-0x0000027F76D40000-0x0000027F76D42000-memory.dmp

Download

memory/3292-8-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3292-18-0x00000000030D0000-0x00000000030D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads