ce221dffd2456b264719031eac5f15bb676c2c2517ead7ba9657bb46dc335c06

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolunaPerm.exe
Size 10.6MB
Sample261107-vwpmbaev6q
SHA256 ce221dffd2456b264719031eac5f15bb676c2c2517ead7ba9657bb46dc335c06
MD5 2ce089cb50c2685a57537ed38cc6f110
SHA1 3ccaa0d61bb4d74aedd691f484581ffc4e6fd937
SHA512 b5216f07f6fdd32f533969b1b3366a628fbc39d980599c9c2209d8d8ac7ae57aa201ae7bb81561e2543b4217d8142a23623cd415106ab5a550b70f193898ab61
SSDEEP 196608:t3o5lQyFOfw7pCQPnsFuv6/YByYDYa9fF9hLoQiHprHV7APbeh:t3o5lQyFOfwVCvsvFkba9f9MQY1V7B
TLSH
T197B6F152F5E301A9E27BC279CF625A06D9B1781C1B2087CF32898A516F537D0AE7E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SolunaPerm.exe
File opened (read-only)	\??\PhysicalDrive1	SolunaPerm.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2800	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SolunaPerm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SolunaPerm.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SolunaPerm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SolunaPerm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SolunaPerm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	SolunaPerm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	SolunaPerm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2832	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3120	SolunaPerm.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2800	3120	SolunaPerm.exe	89
PID 2800 wrote to memory of 4000	2800	cmd.exe	92
PID 2800 wrote to memory of 3308	2800	cmd.exe	93
PID 2800 wrote to memory of 4664	2800	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\SolunaPerm.exe
"C:\Users\Admin\AppData\Local\Temp\SolunaPerm.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\SolunaPerm.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\SolunaPerm.exe" MD5
    3⤵
    PID:4000
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3308
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004B0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads