download:

/quivings/Solara/raw/main/Files/SolaraB.zip

Full analysis: https://app.any.run/tasks/7040de35-392d-4c32-b76d-1788062c9b53
Verdict: Malicious activity
Analysis date: July 22, 2024, 23:31:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

4EC8143B6DBE27870CF8333711FF5096

SHA1:

693D467EBEC348469011FFEF1BD370B113653147

SHA256:

2510BE907EC476E8375AC7B5431536AE9A32BF99FE77AB695A5100852B111B96

SSDEEP:

96:EUqjU52FPuD85CRbXQSQ4Bl1ZP5MaOS5ZTDCJvuB66EFscY7LO4ivJEzmqAZdXRD:EU+FuNQt6JP5GS5NGMYE7TogARskfl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1264)
      • SolaraBootstrapper.exe (PID: 1504)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SolaraBootstrapper.exe (PID: 1504)

    • Process drops legitimate windows executable

      • SolaraBootstrapper.exe (PID: 1504)

    • The process drops C-runtime libraries

      • SolaraBootstrapper.exe (PID: 1504)

    • Reads the date of Windows installation

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)

    • Reads security settings of Internet Explorer

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads the BIOS version

      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

  • INFO

    • Disables trace logs

      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads Environment values

      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Manual execution by a user

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)

    • Checks proxy server information

      • slui.exe (PID: 1568)
      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Checks supported languages

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads the computer name

      • SolaraBootstrapper.exe (PID: 1504)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads the software policy settings

      • SolaraBootstrapper.exe (PID: 1504)
      • slui.exe (PID: 1568)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Reads the machine GUID from the registry

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 3336)
      • cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 5560)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1264)

    • Create files in a temporary directory

      • SolaraBootstrapper.exe (PID: 1504)
      • SolaraBootstrapper.exe (PID: 6284)

    • Dropped object may contain TOR URL's

      • SolaraBootstrapper.exe (PID: 1504)

    • Process checks computer location settings

      • SolaraBootstrapper.exe (PID: 6284)
      • SolaraBootstrapper.exe (PID: 1504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:05:19 18:25:22
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: SolaraB/Solara/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
10
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe no specs rundll32.exe no specs slui.exe solarabootstrapper.exe conhost.exe no specs cd57e4c171d6e8f5ea8b8f824a6a7316.exe solarabootstrapper.exe conhost.exe no specs cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Process information

PID
CMD
Path
Indicators
Parent process
1264"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\SolaraB.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1504"C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe" C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarab\solara\solarabootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1568C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3336"C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe" C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
SolaraBootstrapper.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WpfApp1
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\solara.dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SolaraBootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5032C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5276C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5560"C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe" C:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
SolaraBootstrapper.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WpfApp1
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\solara.dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6284"C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe" C:\Users\admin\Desktop\SolaraB\Solara\SolaraBootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarab\solara\solarabootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SolaraBootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
17 531
Read events
17 478
Write events
53
Delete events
0

Modification events

(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SolaraB.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1504) SolaraBootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1504) SolaraBootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SolaraBootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
12
Suspicious files
173
Text files
9
Unknown types
9

Dropped files

PID
Process
Filename
Type
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dllexecutable
MD5:4D326696FFD80A5BEE016C8B397442C2
SHA256:DB03B4536FBFDCB570945F5942546A19AFE20A7826713BF12F34347EE618F2CA
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\index.jsbinary
MD5:4FE4D2C90A2FD19D6E97443A7D24F815
SHA256:BE2DECBD50610E8F995C1E312EE4DD6D7C1244CFDF03EE4C4A3DA68E572DADA1
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dllexecutable
MD5:34EC990ED346EC6A4F14841B12280C20
SHA256:1E987B22CD011E4396A0805C73539586B67DF172DF75E3DDED16A77D31850409
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\libcurl.dllexecutable
MD5:E31F5136D91BAD0FCBCE053AAC798A30
SHA256:EE94E2201870536522047E6D7FE7B903A63CD2E13E20C8FFFC86D0E95361E671
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\index.jsbinary
MD5:E462FB7561F6C9BCCB24E62BB93889D2
SHA256:FF3FC42D5F912950D1095C43C8EDB8A3BE63C8EEE9DB5CA5D39D5668F68F7B41
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\urlencoded.jsbinary
MD5:906A833480CE8841BFA5AEB95B5C085F
SHA256:752717D87AAD57451638AF2073B04EBA964F348910C0BCF0070C43E732DE5EB2
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\bin\version.txttext
MD5:3FFB7E1BE9CDF02EA2F5C403BA1BB670
SHA256:604751D1D0DE6684FA3D1736599868B1BD8641615F1B1593EAC854CD4589CD27
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\package.jsonbinary
MD5:32A15D6909FCAE63E52D8664593D32D5
SHA256:E5716D5D939DB08C5C28EC6AE86ED67BE5320F91089E2673FCA1C5B876E57AA3
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.zipcompressed
MD5:6C9278827B591E47A451829B8E781D41
SHA256:E2FDD98EF973F17B70D1B4319649F1C72DFF407F2A2C35CF051C2F5A23449449
1504SolaraBootstrapper.exeC:\Users\admin\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\package.jsonbinary
MD5:CB1AA7F817100A03395DD0163BF6EBE9
SHA256:5C5E0E10CFA23F163D1FE68AA57A881D09CAC39D720E1361C697B86C4D33E0F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
48
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
760
lsass.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2628
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3800
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4204
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
7124
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1568
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1504
SolaraBootstrapper.exe
140.82.121.4:443
github.com
GITHUB
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.211.142.183
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.78
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
github.com
  • 140.82.121.4
shared
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
shared
www.bing.com
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.130
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.138
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/quivings/Solara/raw/main/Files/SolaraB.zip