Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2023, 01:25

General

  • Target

    414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe

  • Size

    3.2MB

  • MD5

    31f8c08862caa2ec10a82867dbdf188b

  • SHA1

    144d1037d253808aae23d2fa14d930a76bc7ad51

  • SHA256

    414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf

  • SHA512

    52288d822170c3d813258ed63d97975f5f3f6c0f0d3238fe54a38cfa80f8c675efec3d2ea3a23b15f6d37408f7419f5b17e28970116f919273451190f587083f

  • SSDEEP

    49152:CC9i1Db4FFMmKLZi9gOzDx8iE66tfvbFDfgC0JaRYHw3pjLMRzJwWlo1a4/0fH:xwF4FjGOzF8iAtbFDV0JaRm9RzJGkJv

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.33

Attributes
  • api_key

    d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe
    "C:\Users\Admin\AppData\Local\Temp\414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1256

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    669.8MB

    MD5

    a6fb7b23cf8da8fefb1f9b95171b742c

    SHA1

    c645235f38791650df95183e031df0f7fa6c509e

    SHA256

    d8b3a105f6c3870de43b7ec24b02ca2f550161ae1a183ae66ea52ebc229f04a4

    SHA512

    92127cfa8c7d00688ae3b844c9964513eb4613f9bebe48de5b87a4994113f60eca8a63dfbf81b7c1024f0a133396108773eb0bdefdb83e02aa7a9c77e15ccda0

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    668.0MB

    MD5

    0487ef4b0acc398901ca53b417fc4e7b

    SHA1

    55c024db081607210e4c131c90ef69d9fa0a362a

    SHA256

    ba1b9265594f56b814b9542174427226c463f5e495bf9ca73ea68e0ac02b888e

    SHA512

    64d46612186b197c4902e72c6e5b18c55d9b65f3aca88c06e4f378eb711bf8d65353ba02326a4d460e1b3f1fecd3d3f094724cabee969ac0a9f2caa77f059ed9

  • memory/1256-79-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-72-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-90-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-89-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-74-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-87-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-86-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-76-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-73-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-83-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-82-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-80-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-78-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-85-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-77-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/1256-75-0x0000000000B40000-0x000000000145A000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-64-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-60-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-56-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-54-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-71-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-55-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-57-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-66-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-62-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-61-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-59-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB

  • memory/2000-58-0x0000000000AD0000-0x00000000013EA000-memory.dmp

    Filesize

    9.1MB