File name:

SolaraV3.exe

Full analysis: https://app.any.run/tasks/ea3ed739-d322-4d9d-b6d9-d25167feb99b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 08, 2025, 07:59:05
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
stealer
lumma
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

35E757658C8748AD6A80C2AB74A1F597

SHA1:

42DBFB98D89FBA75F3364509DFE50733DAF1E31F

SHA256:

2F1679DECFDAF4B6FB4EC40E67D6CA1B6862A16CAFC0AEEE8E8AA8166F9FED60

SSDEEP:

12288:b2h+wweEql3LtEZwfsVo4R7VNmztiWCzilrGN2:b0+wwbql3JEa2o4R7VNmzt4zilrT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • SolaraV3.exe (PID: 2268)
      • SolaraV3.exe (PID: 4124)

    • Steals credentials from Web Browsers

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Actions looks like stealing of personal data

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

  • SUSPICIOUS

    • Application launched itself

      • SolaraV3.exe (PID: 2552)

    • Reads the Internet Settings

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Reads settings of System Certificates

      • SolaraV3.exe (PID: 2268)
      • SolaraV3.exe (PID: 4124)

    • Executes application which crashes

      • SolaraV3.exe (PID: 2552)

    • There is functionality for taking screenshot (YARA)

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Connects to the server without a host name

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Executable content was dropped or overwritten

      • SolaraV3.exe (PID: 4124)

    • Process requests binary or script from the Internet

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Searches for installed software

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Potential Corporate Privacy Violation

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

  • INFO

    • Checks supported languages

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2552)
      • SolaraV3.exe (PID: 2268)

    • Reads the computer name

      • SolaraV3.exe (PID: 2552)
      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Reads the software policy settings

      • SolaraV3.exe (PID: 2268)
      • SolaraV3.exe (PID: 4124)
      • WerFault.exe (PID: 4404)

    • Reads the machine GUID from the registry

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)

    • Reads the Internet Settings

      • WerFault.exe (PID: 4404)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 4404)

    • Checks proxy server information

      • WerFault.exe (PID: 4404)

    • Create files in a temporary directory

      • SolaraV3.exe (PID: 4124)
      • SolaraV3.exe (PID: 2268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (81)
.dll | Win32 Dynamic Link Library (generic) (7.2)
.exe | Win32 Executable (generic) (4.9)
.exe | Win16/32 Executable Delphi generic (2.2)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2062:07:03 22:20:15+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 8704
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x3b66
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Portals
FileVersion: 1.0.0.0
InternalName: Portals.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: Portals.exe
ProductName: Portals
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start solarav3.exe solarav3.exe no specs solarav3.exe no specs solarav3.exe no specs #LUMMA solarav3.exe #LUMMA solarav3.exe werfault.exe dn2qcohwugygig7mf.exe no specs dn2qcohwugygig7mf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
820"C:\Users\admin\AppData\Local\Temp\DN2QCOHWUGYGIG7MF.exe"C:\Users\admin\AppData\Local\Temp\DN2QCOHWUGYGIG7MF.exe—SolaraV3.exe
User:
admin
Company:
Microsoft® Windows®
Integrity Level:
MEDIUM
Description:
Programs Engine
Exit code:
3221226540
Version:
10.0.19041.746
Modules
Images
c:\users\admin\appdata\local\temp\dn2qcohwugygig7mf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2268"C:\Users\admin\Desktop\SolaraV3.exe"C:\Users\admin\Desktop\SolaraV3.exe
SolaraV3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Portals
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarav3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
2552"C:\Users\admin\Desktop\SolaraV3.exe" C:\Users\admin\Desktop\SolaraV3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Portals
Exit code:
3221226505
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarav3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
3816"C:\Users\admin\Desktop\SolaraV3.exe"C:\Users\admin\Desktop\SolaraV3.exe—SolaraV3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Portals
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarav3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4012"C:\Users\admin\Desktop\SolaraV3.exe"C:\Users\admin\Desktop\SolaraV3.exe—SolaraV3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Portals
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarav3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4044"C:\Users\admin\AppData\Local\Temp\DN2QCOHWUGYGIG7MF.exe"C:\Users\admin\AppData\Local\Temp\DN2QCOHWUGYGIG7MF.exe—SolaraV3.exe
User:
admin
Company:
Microsoft® Windows®
Integrity Level:
MEDIUM
Description:
Programs Engine
Exit code:
3221226540
Version:
10.0.19041.746
Modules
Images
c:\users\admin\appdata\local\temp\dn2qcohwugygig7mf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4124"C:\Users\admin\Desktop\SolaraV3.exe"C:\Users\admin\Desktop\SolaraV3.exe
SolaraV3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Portals
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarav3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
4404C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 856C:\Windows\SysWOW64\WerFault.exe
SolaraV3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.22000.653 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
4680"C:\Users\admin\Desktop\SolaraV3.exe"C:\Users\admin\Desktop\SolaraV3.exe—SolaraV3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Portals
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\solarav3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
12 626
Read events
12 626
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4404WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SolaraV3.exe_6789558e6f617cce5c35c9a063c4302d05a18_5ea55091_a485815e-1991-4f4f-bb57-f0257900176a\Report.wer —
MD5:—
SHA256:—
4404WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\SolaraV3.exe.2552.dmp —
MD5:—
SHA256:—
4404WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.02f33ed0-e1e2-47c5-966b-1aa8d358377c.tmp.WERInternalMetadata.xmlbinary
MD5:20A5F699EB3829A63DA05FD57CACDE78
SHA256:22AED12945B2BB76A6A85DED267CE55510BA666CBE2CB38FC30DD661DF83212A
4404WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.2dad3259-9acb-4899-968b-9a622ac51f94.tmp.dmpbinary
MD5:D76EFFC23CD1298BF7599ABF1633FA3F
SHA256:2F2A17D0575D6ABDAFB9E9B9FF604BFA46B164F517F8B7EC3D6FB7D582449DFC
4404WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.030c2724-7af5-47d1-ba61-335b4a788210.tmp.xmlxml
MD5:A20A10B0530E888D77538D6B39A2EB9C
SHA256:D73C94111D057360BFFFEFDB52E866FC6C38C12955DC4E2406708455DF8F9E7F
4124SolaraV3.exeC:\Users\admin\AppData\Local\Temp\DN2QCOHWUGYGIG7MF.exeexecutable
MD5:C11A82D699A06D9B8BA4296E0C562AE4
SHA256:483B1D7DAC70DE82E9B22A0C1ED775CF7E10B0A3790C5AA1B9215DBCD1754302
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
34
DNS requests
13
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3596
smartscreen.exe
GET
200
23.50.131.200:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fdd39e59cbab9e4c
unknown
—
—
whitelisted
1352
svchost.exe
GET
200
184.24.77.24:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
—
—
HEAD
200
23.212.222.21:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
unknown
4124
SolaraV3.exe
GET
200
185.215.113.51:80
http://185.215.113.51/conhost.exe
unknown
—
—
malicious
—
—
POST
200
104.21.96.1:443
https://defaulemot.run/jUSiaz
unknown
binary
13.8 Kb
malicious
—
—
POST
200
40.126.31.73:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
104.21.64.1:443
https://defaulemot.run/jUSiaz
unknown
binary
71 b
malicious
—
—
POST
200
104.21.48.1:443
https://defaulemot.run/jUSiaz
unknown
binary
71 b
malicious
—
—
POST
200
104.21.32.1:443
https://defaulemot.run/jUSiaz
unknown
binary
71 b
malicious
—
—
POST
200
20.190.159.64:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1352
svchost.exe
184.24.77.24:80
—
Akamai International B.V.
DE
unknown
3596
smartscreen.exe
172.205.25.163:443
checkappexec.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
VN
whitelisted
3596
smartscreen.exe
23.50.131.200:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
2268
SolaraV3.exe
104.21.112.1:443
defaulemot.run
CLOUDFLARENET
—
malicious
4124
SolaraV3.exe
104.21.112.1:443
defaulemot.run
CLOUDFLARENET
—
malicious
4404
WerFault.exe
13.92.180.205:443
umwatson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1336
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3640
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2776
svchost.exe
51.105.71.136:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
google.com
  • 142.250.181.238
whitelisted
checkappexec.microsoft.com
  • 172.205.25.163
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.200
  • 23.50.131.216
  • 146.75.122.172
whitelisted
defaulemot.run
  • 104.21.112.1
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.16.1
  • 104.21.80.1
  • 104.21.96.1
malicious
umwatson.events.data.microsoft.com
  • 13.92.180.205
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.131
  • 20.190.159.129
  • 40.126.31.67
  • 40.126.31.69
  • 40.126.31.128
  • 40.126.31.73
whitelisted
v10.events.data.microsoft.com
  • 51.105.71.136
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

PID
Process
Class
Message
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
1352
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
4124
SolaraV3.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
4124
SolaraV3.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2268
SolaraV3.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4124
SolaraV3.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4124
SolaraV3.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4124
SolaraV3.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2268
SolaraV3.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2268
SolaraV3.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SolaraV3.exe