Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
288s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
19/12/2022, 03:40
General
-
Target
3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f.exe
-
Size
8.6MB
-
MD5
2160b328dfdbbe8080a40f80ae87af73
-
SHA1
2577334ab8183268e78221adad7b681440b180a6
-
SHA256
3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f
-
SHA512
d2238ede6db9268f6365f18a095158c1862faaa28f84f4dc3b6295aab97b5ce9167d449dc52457a2a42eaccf46bbdae7a82b3cad6fa99ad79900fb41d1c3652b
-
SSDEEP
196608:hT73/ahrYWuQouogKsCuo5aKmU/FkcDrhwJb2No+dFBP6:hT73/azo91la6/Fkcn+0o+dF16
Malware Config
Extracted
laplas
clipper.guru
-
api_key
dd611369e3344bc4aad751531e739d725fb32f33363f67a0bf7a4ea33213af63
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
-
Executes dropped EXE 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f.exe"C:\Users\Admin\AppData\Local\Temp\3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn CthDkNHxan /tr C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn CthDkNHxan /tr C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exeC:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
698.5MB
MD5147872524f9ba64e4c98c3a99869c3ac
SHA1ae6fc84aa8568c0de96d333ebfc0f55e91c335dd
SHA256a4a39770c812bbbf074a93807d14634fb7f05c12593f9aa40223b86eb7f48852
SHA5124aa5566039734933cad2f349d37bbd8c40ed141d061ecfc164a29a0ef6c7050414730ed1f15e989ebf48659656565105ba0544e43ef49eb8ccca581c922a9524
-
Filesize
698.5MB
MD5147872524f9ba64e4c98c3a99869c3ac
SHA1ae6fc84aa8568c0de96d333ebfc0f55e91c335dd
SHA256a4a39770c812bbbf074a93807d14634fb7f05c12593f9aa40223b86eb7f48852
SHA5124aa5566039734933cad2f349d37bbd8c40ed141d061ecfc164a29a0ef6c7050414730ed1f15e989ebf48659656565105ba0544e43ef49eb8ccca581c922a9524
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.8MB
-
Filesize
16.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.8MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB