Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2023, 02:13

General

  • Target

    setup.exe

  • Size

    1.9MB

  • MD5

    7e1ee04719bea1b532ed44609632ccd9

  • SHA1

    f6ad1ded616f8877cb34f873b3597aa6df50e957

  • SHA256

    b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc

  • SHA512

    0bbb7c9e68f27d05476a301ec95b0a3ee7ab46ab3e912adcb14bbe44015b07ef1668e076518076abf79c6b366a1d59f057553411383a263ab539786853bc2819

  • SSDEEP

    24576:prRWZ35JhqWpgXEC9CsacGA2XqHO4fOD22eAbFKhvb12pG5UojUsw1EyYMoPBETh:prsvJhS7Rj26H/fOyj1qG5UojUslMoJ

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Executes dropped EXE
      PID:5060

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    808.9MB

    MD5

    720c1b26403ce07f4b84457585c4332a

    SHA1

    9b89fa1da5ad495e2eec9df88fb404e95a2d3342

    SHA256

    67aafdee90d6444f1bf06a15ff3887486fef11529d270113860341ead865b254

    SHA512

    8d509aec901fbd645a315aea534004e2cc89a7c371753c4a6161158c110b7020864b6dc9f171f9c4d9f339b474788fef1c82341095f715abc3d84bf51fbb2bfb

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    808.9MB

    MD5

    720c1b26403ce07f4b84457585c4332a

    SHA1

    9b89fa1da5ad495e2eec9df88fb404e95a2d3342

    SHA256

    67aafdee90d6444f1bf06a15ff3887486fef11529d270113860341ead865b254

    SHA512

    8d509aec901fbd645a315aea534004e2cc89a7c371753c4a6161158c110b7020864b6dc9f171f9c4d9f339b474788fef1c82341095f715abc3d84bf51fbb2bfb

  • memory/3704-134-0x0000000004B20000-0x0000000004EF0000-memory.dmp

    Filesize

    3.8MB

  • memory/3704-140-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-146-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-149-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-143-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-145-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-141-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-147-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-148-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-142-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-150-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-151-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-152-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-153-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-154-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/5060-155-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB