File name:

Solara.exe

Full analysis: https://app.any.run/tasks/90215e01-a433-4954-ae3d-10ed38341628
Verdict: Malicious activity
Analysis date: July 27, 2024, 17:40:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

75C677F483139B1A2BA22B52D37A7402

SHA1:

9F11A7C2738EE1604792FE35EE53A66A32417B56

SHA256:

C655DD31CC357860015E8DA254F7388A4DA38E24BD3B6AEAE3305F64863BFA5F

SSDEEP:

1536:EfWk5LDaehNff5Q1xtffW0MnggtaTuzbOmrrLzC6EGUWJOOT2QoK2:YfZfCVHgYizbOorLzC6RUmOOTHA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Solara.exe (PID: 3848)

  • SUSPICIOUS

    • Executes application which crashes

      • Solara.exe (PID: 3848)

    • Checks for external IP

      • svchost.exe (PID: 2284)
      • Solara.exe (PID: 3848)

  • INFO

    • Reads the computer name

      • Solara.exe (PID: 3848)

    • Checks supported languages

      • Solara.exe (PID: 3848)

    • Disables trace logs

      • Solara.exe (PID: 3848)

    • Checks proxy server information

      • Solara.exe (PID: 3848)
      • slui.exe (PID: 4500)
      • WerFault.exe (PID: 6352)
      • slui.exe (PID: 7624)

    • Reads the machine GUID from the registry

      • Solara.exe (PID: 3848)

    • Reads Environment values

      • Solara.exe (PID: 3848)

    • Reads the software policy settings

      • slui.exe (PID: 4500)
      • WerFault.exe (PID: 6352)
      • slui.exe (PID: 7624)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:26 20:36:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 80896
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x15ade
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Solara.exe
LegalCopyright:
OriginalFileName: Solara.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start solara.exe slui.exe werfault.exe svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2284C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3848"C:\Users\admin\AppData\Local\Temp\Solara.exe" C:\Users\admin\AppData\Local\Temp\Solara.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
2148734499
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\solara.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4500C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6352C:\WINDOWS\system32\WerFault.exe -u -p 3848 -s 1764C:\Windows\System32\WerFault.exe
Solara.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
7624C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 576
Read events
6 558
Write events
18
Delete events
0

Modification events

(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3848) Solara.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Solara_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6352WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Solara.exe_eeee91bb7fcc33eff98754c11b51c9b56f1f91_95d6a491_bb21c4f1-0b3e-421d-bba6-a01ce3a89558\Report.wer —
MD5:—
SHA256:—
6352WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Solara.exe.3848.dmp —
MD5:—
SHA256:—
6352WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
6352WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER168F.tmp.xmlxml
MD5:3E1F41E9200359F3FF08EA0B23F6DDB1
SHA256:C57A1FB983B63D17053BB5C0FBB3F2F5FA7A3E0FC5C120E451C56662FCB6322D
6352WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
6352WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER14E7.tmp.dmpbinary
MD5:099D96E7B16B24944206E32F43012ED6
SHA256:38A0E6FB6E9A02CE3C4DD5F8447E6A18FCF7F63945A8FD3BD21F49F100517EE2
6352WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER166F.tmp.WERInternalMetadata.xmlxml
MD5:CB5A15D1FCECE99FAE6E01CC2BBE0102
SHA256:02227ED48EDFAD241894A96FB054C2B3C4FC2D4B39100105FC23B2BC24B97588
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
60
DNS requests
32
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3848
Solara.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
396
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5368
SearchApp.exe
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5368
SearchApp.exe
92.123.104.40:443
www.bing.com
Akamai International B.V.
DE
unknown
4436
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6012
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1560
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5804
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
204
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4500
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 92.123.104.40
  • 92.123.104.9
  • 92.123.104.36
  • 92.123.104.52
  • 92.123.104.61
  • 92.123.104.33
  • 92.123.104.32
  • 92.123.104.64
  • 92.123.104.67
  • 2.23.209.158
  • 2.23.209.177
  • 2.23.209.148
  • 2.23.209.182
  • 2.23.209.179
  • 2.23.209.140
  • 2.23.209.176
  • 2.23.209.149
  • 2.23.209.150
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
ip-api.com
  • 208.95.112.1
shared
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.68
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted

Threats

PID
Process
Class
Message
2284
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
3848
Solara.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
3848
Solara.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2284
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
Process
Message
Solara.exe
CLR: Managed code called FailFast without specifying a reason.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Solara.exe