IOC Report
Solara.exe

loading gif

Files

File Path
Type
Category
Malicious
Solara.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Solara.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\msvcp110.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Solara.exe
"C:\Users\user\Desktop\Solara.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
enlargkiw.sbs
malicious
allocatinow.sbs
malicious
drawwyobstacw.sbs
malicious
mathcucom.sbs
malicious
https://steamcommunity.com/profiles/76561199724331900
104.102.49.254
 malicious
https://vennurviot.sbs/api
172.67.140.193
 malicious
https://steamcommunity.com/profiles/76561199724331900/inventory/
unknown
 malicious
ehticsprocw.sbs
malicious
passimovrt.cfd
malicious
condifendteu.sbs
malicious
https://drawwyobstacw.sbs/api
188.114.96.3
 malicious
https://resinedyw.sbs/api
104.21.77.78
 malicious
https://www.cloudflare.com/learning/access-management/phishing-attack/
unknown
https://player.vimeo.com
unknown
https://ehticsprocw.sbs/apig
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
unknown
https://enlargkiw.sbs/apibs
unknown
https://steamcommunity.com/?subsection=broadcasts
unknown
https://sergei-esenin.com/
unknown
https://vennurviot.sbs/
unknown
https://store.steampowered.com/subscriber_agreement/
unknown
https://www.gstatic.cn/recaptcha/
unknown
https://sergei-esenin.com/apiS-
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
unknown
http://www.valvesoftware.com/legal.htm
unknown
https://www.youtube.com
unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
unknown
https://www.google.com
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
unknown
https://ehticsprocw.sbs/api=
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
https://allocatinow.sbs/2k
unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi
unknown
https://s.ytimg.com;
unknown
https://steam.tv/
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
unknown
http://store.steampowered.com/privacy_agreement/
unknown
https://store.steampowered.com/points/shop/
unknown
https://sketchfab.com
unknown
https://lv.queniujq.cn
unknown
https://www.youtube.com/
unknown
https://mathcucom.sbs/#f
unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
unknown
https://store.steampowered.com/privacy_agreement/
unknown
https://www.cloudflare.com/5xx-error-landing
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a
unknown
https://mathcucom.sbs/
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
unknown
https://www.google.com/recaptcha/
unknown
https://checkout.steampowered.com/
unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
unknown
https://ehticsprocw.sbs/apis
unknown
https://sergei-esenin.com/apir
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
unknown
https://avatars.akamai.steamstatic
unknown
https://ehticsprocw.sbs/
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
unknown
https://store.steampowered.com/;
unknown
https://sergei-esenin.com/apiv
unknown
https://store.steampowered.com/about/
unknown
https://steamcommunity.com/my/wishlist/
unknown
https://steamcommunity.com//
unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
unknown
https://ehticsprocw.sbs/7
unknown
https://help.steampowered.com/en/
unknown
https://allocatinow.sbs/api7
unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
unknown
https://steamcommunity.com/market/
unknown
https://store.steampowered.com/news/
unknown
https://community.akamai.steamstatic.com/
unknown
https://sergei-esenin.com/8
unknown
http://store.steampowered.com/subscriber_agreement/
unknown
https://allocatinow.sbs/api
unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
unknown
https://sergei-esenin.com//
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
unknown
https://recaptcha.net/recaptcha/;
unknown
https://sergei-esenin.com/0
unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
unknown
https://passimovrt.cfd/
unknown
https://steamcommunity.com/discussions/
unknown
https://store.steampowered.com/stats/
unknown
https://medal.tv
unknown
https://broadcast.st.dl.eccdnx.com
unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
unknown
https://store.steampowered.com/steam_refunds/
unknown
https://resinedyw.sbs/
unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
unknown
https://vennurviot.sbs/apis
unknown
https://allocatinow.sbs/pi
unknown
https://ehticsprocw.sbs/.
unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
condifendteu.sbs
172.67.141.136
 malicious
steamcommunity.com
104.102.49.254
 malicious
vennurviot.sbs
172.67.140.193
 malicious
drawwyobstacw.sbs
188.114.96.3
 malicious
mathcucom.sbs
188.114.97.3
 malicious
sergei-esenin.com
104.21.53.8
 malicious
passimovrt.cfd
104.21.28.222
 malicious
ehticsprocw.sbs
104.21.30.221
 malicious
resinedyw.sbs
104.21.77.78
 malicious
enlargkiw.sbs
104.21.33.249
 malicious
allocatinow.sbs
unknown
 malicious
fp2e7a.wpc.phicdn.net
192.229.221.95
There are 2 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
104.21.53.8
sergei-esenin.com
United States
malicious
188.114.97.3
mathcucom.sbs
European Union
malicious
104.21.33.249
enlargkiw.sbs
United States
malicious
104.21.30.221
ehticsprocw.sbs
United States
malicious
188.114.96.3
drawwyobstacw.sbs
European Union
malicious
172.67.141.136
condifendteu.sbs
United States
malicious
104.102.49.254
steamcommunity.com
United States
malicious
104.21.28.222
passimovrt.cfd
United States
malicious
172.67.140.193
vennurviot.sbs
United States
malicious
104.21.77.78
resinedyw.sbs
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
308A000
heap
page read and write
3012000
heap
page read and write
3091000
heap
page read and write
2F7E000
stack
page read and write
3091000
heap
page read and write
3093000
heap
page read and write
3040000
heap
page read and write
3093000
heap
page read and write
2F3B000
stack
page read and write
B1F000
stack
page read and write
4DCE000
stack
page read and write
2F80000
heap
page read and write
2840000
heap
page execute and read and write
3097000
heap
page read and write
302B000
heap
page read and write
2FFC000
heap
page read and write
3028000
heap
page read and write
D00000
heap
page read and write
3028000
heap
page read and write
300A000
heap
page read and write
B37000
trusted library allocation
page execute and read and write
30A0000
heap
page read and write
309B000
heap
page read and write
710000
heap
page read and write
6CF7A000
unkown
page readonly
306A000
heap
page read and write
4C60000
remote allocation
page read and write
308D000
heap
page read and write
5430000
heap
page read and write
4055000
trusted library allocation
page read and write
30AB000
heap
page read and write
4C80000
heap
page read and write
3087000
heap
page read and write
3091000
heap
page read and write
D30000
trusted library allocation
page read and write
277E000
stack
page read and write
285B000
trusted library allocation
page read and write
3091000
heap
page read and write
306A000
heap
page read and write
2A2000
unkown
page execute and read and write
955000
heap
page read and write
30C1000
heap
page read and write
2867000
trusted library allocation
page read and write
3008000
heap
page read and write
3028000
heap
page read and write
301C000
heap
page read and write
3028000
heap
page read and write
B70000
heap
page read and write
CF0000
trusted library allocation
page execute and read and write
3028000
heap
page read and write
4C60000
remote allocation
page read and write
B3B000
stack
page read and write
3851000
trusted library allocation
page read and write
3040000
heap
page read and write
3098000
heap
page read and write
3040000
heap
page read and write
302B000
heap
page read and write
30AB000
heap
page read and write
3040000
heap
page read and write
92E000
heap
page read and write
308B000
heap
page read and write
85E000
stack
page read and write
302B000
heap
page read and write
302B000
heap
page read and write
EDF000
stack
page read and write
2FDD000
stack
page read and write
BFE000
stack
page read and write
8DE000
stack
page read and write
308A000
heap
page read and write
32AE000
stack
page read and write
4D8E000
stack
page read and write
920000
heap
page read and write
30C1000
heap
page read and write
33AE000
stack
page read and write
BE0000
heap
page read and write
914000
trusted library allocation
page read and write
B9E000
stack
page read and write
3028000
heap
page read and write
309A000
heap
page read and write
3097000
heap
page read and write
DA0000
trusted library section
page read and write
3040000
heap
page read and write
3040000
heap
page read and write
94C000
heap
page read and write
30A0000
heap
page read and write
947000
heap
page read and write
3012000
heap
page read and write
3012000
heap
page read and write
553F000
stack
page read and write
903000
trusted library allocation
page execute and read and write
30C1000
heap
page read and write
3028000
heap
page read and write
30D4000
heap
page read and write
D20000
trusted library allocation
page read and write
3028000
heap
page read and write
306A000
heap
page read and write
302B000
heap
page read and write
529D000
stack
page read and write
A4FE000
stack
page read and write
3089000
heap
page read and write
4E30000
heap
page execute and read and write
3040000
heap
page read and write
965000
heap
page read and write
9CF000
heap
page read and write
30CE000
heap
page read and write
4DCD000
stack
page read and write
991000
heap
page read and write
39C000
stack
page read and write
4CCD000
stack
page read and write
3091000
heap
page read and write
30AD000
heap
page read and write
494D000
stack
page read and write
306A000
heap
page read and write
3094000
heap
page read and write
4E0E000
stack
page read and write
5641000
trusted library allocation
page read and write
3098000
heap
page read and write
3094000
heap
page read and write
3091000
heap
page read and write
302B000
heap
page read and write
308A000
heap
page read and write
2A2000
unkown
page readonly
3012000
heap
page read and write
CEF000
stack
page read and write
540E000
stack
page read and write
3091000
heap
page read and write
4C60000
remote allocation
page read and write
306A000
heap
page read and write
3012000
heap
page read and write
904000
trusted library allocation
page read and write
30AB000
heap
page read and write
700000
heap
page read and write
306A000
heap
page read and write
4657000
trusted library allocation
page read and write
3009000
heap
page read and write
4C4E000
stack
page read and write
539E000
stack
page read and write
3009000
heap
page read and write
3097000
heap
page read and write
2851000
trusted library allocation
page read and write
3012000
heap
page read and write
3097000
heap
page read and write
3097000
heap
page read and write
6CEF1000
unkown
page execute read
BDE000
stack
page read and write
45B000
remote allocation
page execute and read and write
30CF000
heap
page read and write
B75000
heap
page read and write
306A000
heap
page read and write
3099000
heap
page read and write
910000
trusted library allocation
page read and write
30CE000
heap
page read and write
3091000
heap
page read and write
30CE000
heap
page read and write
BB0000
heap
page read and write
302B000
heap
page read and write
9CB000
heap
page read and write
308B000
heap
page read and write
3009000
heap
page read and write
2FE0000
heap
page read and write
30D4000
heap
page read and write
745000
heap
page read and write
309B000
heap
page read and write
3092000
heap
page read and write
73BE000
stack
page read and write
30D4000
heap
page read and write
2A0000
unkown
page readonly
958000
heap
page read and write
3099000
heap
page read and write
6CEF0000
unkown
page readonly
30A2000
heap
page read and write
89D000
stack
page read and write
D80000
heap
page read and write
740000
heap
page read and write
3040000
heap
page read and write
3028000
heap
page read and write
302B000
heap
page read and write
308B000
heap
page read and write
3087000
heap
page read and write
3098000
heap
page read and write
DD0000
heap
page read and write
306A000
heap
page read and write
6CF23000
unkown
page read and write
3009000
heap
page read and write
301C000
heap
page read and write
3040000
heap
page read and write
302B000
heap
page read and write
3092000
heap
page read and write
308D000
heap
page read and write
308A000
heap
page read and write
72BD000
stack
page read and write
3087000
heap
page read and write
6FB000
stack
page read and write
B3B000
trusted library allocation
page execute and read and write
928000
heap
page read and write
308A000
heap
page read and write
3012000
heap
page read and write
308D000
heap
page read and write
6CF1C000
unkown
page readonly
306A000
heap
page read and write
30D4000
heap
page read and write
2A0000
unkown
page execute and read and write
8F0000
trusted library allocation
page read and write
3091000
heap
page read and write
3093000
heap
page read and write
E00000
heap
page read and write
30C1000
heap
page read and write
A3FE000
stack
page read and write
2863000
trusted library allocation
page read and write
D7E000
stack
page read and write
3091000
heap
page read and write
525F000
stack
page read and write
3008000
heap
page read and write
515E000
stack
page read and write
There are 205 hidden memdumps, click here to show them.