Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
269s -
max time network
286s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
27/04/2023, 22:17
General
-
Target
ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804.exe
-
Size
3.8MB
-
MD5
777c97f2898d88b9ac5eecc17d2a9bfb
-
SHA1
753c0828aeac6f2c9ac0f9c64eec30248dac0e32
-
SHA256
ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804
-
SHA512
35f47a96b91f6eec58cae5cfc1cea36d2dc14b880635f63e891edb0676bd38569f98623c1ff3655eaadb1d7ffbf2cd9df1503c890876df928a552db4d671c02e
-
SSDEEP
98304:UHCQqJ34uxaJl5to8lsk6Qe934SJwecdW9D:UHuraX5Osb6QsJJ
Malware Config
Extracted
laplas
http://45.159.189.33
-
api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804.exe"C:\Users\Admin\AppData\Local\Temp\ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
801.8MB
MD592c67e4bc0fea0efd445149726c41f35
SHA16c4663941a5907d2150d3880310b1c1c0a3e2ace
SHA256e6684934c6c478be2c1479cee4e8b93797d1b9955554f0ee57d29c7d018db4aa
SHA512ab8ba41909e8e02b42f2bdf39cf19256da87f1afbdd0fe01baac0bf43ebbb7fe174feec7e6f14f0acc86584071ced28c3f5d6837b0a4011f86221005edfd7028
-
Filesize
801.8MB
MD592c67e4bc0fea0efd445149726c41f35
SHA16c4663941a5907d2150d3880310b1c1c0a3e2ace
SHA256e6684934c6c478be2c1479cee4e8b93797d1b9955554f0ee57d29c7d018db4aa
SHA512ab8ba41909e8e02b42f2bdf39cf19256da87f1afbdd0fe01baac0bf43ebbb7fe174feec7e6f14f0acc86584071ced28c3f5d6837b0a4011f86221005edfd7028
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB