Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
295s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
20/04/2023, 22:17
General
-
Target
9f35ecf414df4f8e3d0bfa41cea9ebf0827a271941555cabaf22530d774bd999.exe
-
Size
2.7MB
-
MD5
20974e780438e87cf0fab2e4c10aa72a
-
SHA1
577e4d37c6897e550abe430d58577b595ed6d2a9
-
SHA256
9f35ecf414df4f8e3d0bfa41cea9ebf0827a271941555cabaf22530d774bd999
-
SHA512
c40c222c127d002ea647f3a447426099c7e20f2c9cee48d60f626222e27123406f18e84a2e0774f1725dde001691525487f37e753c5c1dd026b84c958d017e61
-
SSDEEP
49152:izUKp+KxzGMns8LyGuD7wdwrYvihsZqkWo9pG7XnkMcfWzE65Gl9R/4xEozse:iYKpbxZDyGuDkdRiOZRd9e5KW4aGd/6N
Malware Config
Extracted
laplas
http://45.159.189.105
-
api_key
7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f35ecf414df4f8e3d0bfa41cea9ebf0827a271941555cabaf22530d774bd999.exe"C:\Users\Admin\AppData\Local\Temp\9f35ecf414df4f8e3d0bfa41cea9ebf0827a271941555cabaf22530d774bd999.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
785.7MB
MD5e332503d4dc9372e5f7d3ae35ca3513b
SHA185f2e8d6b51f9519a5509c0535870a04a5192e12
SHA256cd758e3c0758a8fd8325781e9f93566886a676ae591c2da138708c07abbc90c2
SHA512bb559ddb097560f554a50d4a04bae1632e3573520231d4a4016e26445b72ec23c3aab33eb60d7a693aea40d56616b544f904b51411df43aa5d7972b653ad28b0
-
Filesize
785.7MB
MD5e332503d4dc9372e5f7d3ae35ca3513b
SHA185f2e8d6b51f9519a5509c0535870a04a5192e12
SHA256cd758e3c0758a8fd8325781e9f93566886a676ae591c2da138708c07abbc90c2
SHA512bb559ddb097560f554a50d4a04bae1632e3573520231d4a4016e26445b72ec23c3aab33eb60d7a693aea40d56616b544f904b51411df43aa5d7972b653ad28b0
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB