SolaraV3[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SolaraV3.exe
Size 19.6MB
Sample261110-qf8ysstwhy
SHA256 30ccfb4bf39514f681f171230d78fe5ffb3725ec3bc1ee00f2c3e71b3afa4d11
MD5 317035e2736d0791f6ff7f9750e1bc15
SHA1 23f914d5877b8e9a0bb6abcb5312943b6a29be5c
SHA512 9d8c5cf4e1e3ad6e74262b9dbb038199035f7ed749192e53f324009da888426133675fa97c0aa40a1f8b3172277d2c0fd5899b544ceb7ac6800496560268a44d
SSDEEP 196608:qsSx9kTwNMdIz7dVDe3SCTUBEfYVw5te8u93eYzmTIeqlst:qDcTwNMdIz7dVDe3SCyVw5seYi0e4st
TLSH
T16727F8607A9B99ACD09AC47483478A720A3130DB0B35B9BF44D496393F6DBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SolaraV3.exe

File Explorer

SolaraV3.exe

.exe 19.6MB

SolaraV3.exe

IMPHASH 4bf82d7b33ed65a5b0f9ae39fc7989ad
SHA256 30ccfb4bf39514f681f171230d78fe5ffb3725ec3bc1ee00f2c3e71b3afa4d11
MD5 317035e2736d0791f6ff7f9750e1bc15
SHA1 23f914d5877b8e9a0bb6abcb5312943b6a29be5c
SHA512 9d8c5cf4e1e3ad6e74262b9dbb038199035f7ed749192e53f324009da888426133675fa97c0aa40a1f8b3172277d2c0fd5899b544ceb7ac6800496560268a44d
SSDEEP 196608:qsSx9kTwNMdIz7dVDe3SCTUBEfYVw5te8u93eYzmTIeqlst:qDcTwNMdIz7dVDe3SCyVw5seYi0e4st
TLSH
T16727F8607A9B99ACD09AC47483478A720A3130DB0B35B9BF44D496393F6DBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13733216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SolaraV3.pdb

kernel32

MultiByteToWideChar CreateWaitableTimerExW SetEnvironmentVariableW DeleteFileW DeviceIoControl GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose LCIDToLocaleName FindFirstFileExW CopyFileExW RemoveDirectoryW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetWaitableTimer SetFilePointerEx CreateDirectoryW GetStdHandle WriteConsoleW GetWindowsDirectoryW GetTempPathW GetEnvironmentStringsW GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW GetFullPathNameW SetLastError FindNextFileW SleepEx WriteFileEx SetHandleInformation WaitForSingleObject FreeEnvironmentStringsW OutputDebugStringA OutputDebugStringW CompareStringOrdinal GetEnvironmentVariableW GetUserDefaultUILanguage GetModuleHandleW CreateProcessW ReleaseSRWLockExclusive lstrlenW GetCurrentThreadId RtlVirtualUnwind AcquireSRWLockExclusive WakeAllConditionVariable Process32NextW Process32FirstW CreateToolhelp32Snapshot GetConsoleOutputCP SleepConditionVariableSRW GetSystemTimeAsFileTime LoadLibraryA GetConsoleMode GetFileInformationByHandle GetFileAttributesW SetFileCompletionNotificationModes GetQueuedCompletionStatusEx LoadLibraryW CreateIoCompletionPort GetSystemDirectoryW CancelIoEx ConnectNamedPipe GetNamedPipeClientProcessId IsProcessorFeaturePresent RtlPcToFileHeader CreateNamedPipeW WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult LocalFree RaiseException QueryFullProcessImageNameW GetCurrentProcess CreateFileW SetNamedPipeHandleState FlsAlloc TerminateProcess OpenProcess GetModuleHandleA Sleep FlsGetValue FlsSetValue FormatMessageW LoadLibraryExA FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx HeapFree HeapAlloc GetProcessHeap CloseHandle GetModuleFileNameW FreeLibrary SetThreadErrorMode GetProcAddress GetLastError LoadLibraryExW InitializeCriticalSectionEx GetTimeZoneInformationForYear DeleteCriticalSection

advapi32

GetTokenInformation SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW EventRegister EventSetInformation RegDeleteValueW RegOpenKeyExW RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegQueryValueExW EventWriteTransfer EventUnregister RegGetValueW OpenProcessToken RegCloseKey

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

ntdll

NtCreateFile RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtCancelIoFileEx NtWriteFile NtOpenFile NtCreateNamedPipeFile RtlGetVersion

user32

TranslateAcceleratorW GetMenuBarInfo DestroyMenu DrawIconEx CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenu GetMessageA DrawMenuBar SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable GetMenuItemInfoW TranslateMessage CreateIcon GetAsyncKeyState GetKeyboardState GetMenu IsWindowVisible MapVirtualKeyExW ToUnicodeEx GetKeyState EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow DestroyIcon GetWindowDC SendMessageTimeoutW GetRawInputData GetKeyboardLayout SetWindowDisplayAffinity SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor DrawTextW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetMessageW RegisterWindowMessageA SetParent MapWindowPoints GetWindow VkKeyScanW DestroyWindow SetFocus ShowWindow ReleaseDC GetWindowRect SetWindowLongPtrW DispatchMessageW PeekMessageW GetParent GetWindowLongPtrW PostMessageW FindWindowExW SetWindowRgn OffsetRect EnableWindow PostThreadMessageW RedrawWindow IsWindowEnabled IsProcessDPIAware GetDC FlashWindowEx MessageBoxW DefWindowProcW ScreenToClient DispatchMessageA GetForegroundWindow GetWindowLongW GetClientRect RegisterTouchWindow IsWindow AdjustWindowRectEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos ClientToScreen IsIconic EnumChildWindows CreateWindowExW RegisterClassExW GetCursorPos AdjustWindowRect LoadCursorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SendMessageW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow

shell32

SHCreateItemFromParsingName SHFileOperationW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW DragQueryFileW DragFinish

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

comctl32

DefSubclassProc TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass

ole32

CoTaskMemAlloc RevokeDragDrop CoInitializeEx CoCreateInstance OleInitialize RegisterDragDrop CoUninitialize CoTaskMemFree CoCreateFreeThreadedMarshaler

gdi32

CreateSolidBrush GetDeviceCaps CreateRectRgn BitBlt DeleteObject CombineRgn SetTextColor SetBkMode DeleteDC SelectObject CreateDIBSection CreateCompatibleDC

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

ws2_32

WSASocketW bind connect WSAIoctl freeaddrinfo WSACleanup WSAStartup shutdown getaddrinfo closesocket WSAGetLastError getsockopt ioctlsocket setsockopt send WSASend recv getsockname getpeername

secur32

DecryptMessage InitializeSecurityContextW QueryContextAttributesW FreeCredentialsHandle EncryptMessage DeleteSecurityContext AcceptSecurityContext ApplyControlToken FreeContextBuffer AcquireCredentialsHandleA

crypt32

CertDuplicateStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateChain

bcrypt

BCryptGenRandom

iphlpapi

GetExtendedTcpTable

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strcpy_s wcscmp strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr floor trunc round roundf pow

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _initialize_onexit_table __p___argc _exit exit _initterm_e _set_app_type terminate _initterm _register_onexit_function _crt_atexit _get_initial_narrow_environment _configure_narrow_argv abort _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode calloc free _callnewh