Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 17:20
Static task
static1
Behavioral task
behavioral1
Sample
1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe
Resource
win10v2004-20230220-en
General
-
Target
1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe
-
Size
1.9MB
-
MD5
2cab02f2e9bdffa47eabd1fe499cb659
-
SHA1
dda9070cebb6e9f4cd452ab681815497d590a719
-
SHA256
1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0
-
SHA512
2b56cae6faa229365a7b1297ab5078fef485b6084ba5ac699cde93af700f831d92c58f5dcffd08b7ec7187b2b173036b4ddeb197b16f8c429f6e0136cc1b8079
-
SSDEEP
49152:Z4W99T3jU5/iEhr9pk59e0GPkZs9M47Ke2t/vGlcC6H7WCag6lX:Zj/T3IFiA85GNKp5GlGH7W66lX
Malware Config
Extracted
laplas
http://45.87.154.105
-
api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ntlhost.exepid process 1116 ntlhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 47 Go-http-client/1.1 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exedescription pid process target process PID 444 wrote to memory of 1116 444 1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe ntlhost.exe PID 444 wrote to memory of 1116 444 1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe ntlhost.exe PID 444 wrote to memory of 1116 444 1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe ntlhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe"C:\Users\Admin\AppData\Local\Temp\1e85dc00b32d476b0f48f95c74b4d414a91144f5b181815d55908067ac0f25c0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeFilesize
705.9MB
MD5e88d644c331c07ab34086f13bbba35d8
SHA157bef2bc1954639c965bce403ec09c488192ab74
SHA256f99045020cfbb49b7ad19f1a027aa26135a7894cf1843ab657ab402d1c9ba2d2
SHA512eb10a8315218fe8c08d60c2384c21ed91b9278675170ca7dfcf76f3214f8d65421fd5a47a820c6a156caea76c5b1e6b518a5e4c66c5f3e8313fd75ff4c769504
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeFilesize
705.9MB
MD5e88d644c331c07ab34086f13bbba35d8
SHA157bef2bc1954639c965bce403ec09c488192ab74
SHA256f99045020cfbb49b7ad19f1a027aa26135a7894cf1843ab657ab402d1c9ba2d2
SHA512eb10a8315218fe8c08d60c2384c21ed91b9278675170ca7dfcf76f3214f8d65421fd5a47a820c6a156caea76c5b1e6b518a5e4c66c5f3e8313fd75ff4c769504
-
memory/444-134-0x0000000002AE0000-0x0000000002EB0000-memory.dmpFilesize
3.8MB
-
memory/444-136-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/444-139-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-146-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-143-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-144-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-142-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-147-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-148-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-149-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-150-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-151-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-152-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-153-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB
-
memory/1116-154-0x0000000000400000-0x00000000009D8000-memory.dmpFilesize
5.8MB