Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
27/04/2023, 22:17
General
-
Target
ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804.exe
-
Size
3.8MB
-
MD5
777c97f2898d88b9ac5eecc17d2a9bfb
-
SHA1
753c0828aeac6f2c9ac0f9c64eec30248dac0e32
-
SHA256
ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804
-
SHA512
35f47a96b91f6eec58cae5cfc1cea36d2dc14b880635f63e891edb0676bd38569f98623c1ff3655eaadb1d7ffbf2cd9df1503c890876df928a552db4d671c02e
-
SSDEEP
98304:UHCQqJ34uxaJl5to8lsk6Qe934SJwecdW9D:UHuraX5Osb6QsJJ
Malware Config
Extracted
laplas
http://45.159.189.33
-
api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804.exe"C:\Users\Admin\AppData\Local\Temp\ecd7e821527f03f36285b47b459f63f8518f9dc96ec15eef8390c520bb8ba804.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
790.8MB
MD5adb9a5b5fccc3bff49299dc820b0b59b
SHA1f4ec8590b52de0955965da3640c12ce107df329d
SHA256bfbc60b5a2b09a17d960ab4e96e587fee086dcf2ae894d2992336eeeeda94140
SHA5123f2cc16ff9a6098ea8e3242241fa355fefea5e9da6199b7bb35eecb477c8564bdf10ce363ca4d55aa6b04c65c3057edd959a38dc32afa9989e9e59ddbe8d4a33
-
Filesize
790.8MB
MD5adb9a5b5fccc3bff49299dc820b0b59b
SHA1f4ec8590b52de0955965da3640c12ce107df329d
SHA256bfbc60b5a2b09a17d960ab4e96e587fee086dcf2ae894d2992336eeeeda94140
SHA5123f2cc16ff9a6098ea8e3242241fa355fefea5e9da6199b7bb35eecb477c8564bdf10ce363ca4d55aa6b04c65c3057edd959a38dc32afa9989e9e59ddbe8d4a33
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB