Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    198s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2023, 06:10

General

  • Target

    b93d0d4b15a7c44c7be7513a952dd5f71c018ac75a8c8dbac88c3c49aad00b81.exe

  • Size

    3.6MB

  • MD5

    790cc6250e75861e6c0fd25fd041be87

  • SHA1

    0294cd435b2916514245bcf36834a598946f69ac

  • SHA256

    b93d0d4b15a7c44c7be7513a952dd5f71c018ac75a8c8dbac88c3c49aad00b81

  • SHA512

    9ce86bd36b51f9bd20279ca1538b6e7cb7ec06f6650f40f5204ea57ea673ea1118d994c2ef360beaa0d29582fc618380e3f26cddd4dfd3ae1b32e0a845ba0ffb

  • SSDEEP

    49152:QAx2ellLgDUJiNKl7cIlIMkQ0KHr5xbnxxr2Xki9j+zs/7XuUf7fZeYb0BIJ9Lkr:QxeXLPgNYIMkQNHr5zh8kiQA/6ULQF9r

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b93d0d4b15a7c44c7be7513a952dd5f71c018ac75a8c8dbac88c3c49aad00b81.exe
    "C:\Users\Admin\AppData\Local\Temp\b93d0d4b15a7c44c7be7513a952dd5f71c018ac75a8c8dbac88c3c49aad00b81.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    304.9MB

    MD5

    a16fdea73ee70e4e3b9d4ef4f7039cc4

    SHA1

    cd84b24c405f6c8d6fb890d5e1f92e0c9b1425d2

    SHA256

    aae0572028c9fa9da0e5cdfdc925f914f2b4eb37d5eced4860a314dfda969b09

    SHA512

    d5e48587e8cb209dfb1a38b74cd6c48dfc72ed2bc9dd0bc8e455fce8717f7f336a4570f0b2619513e9a20b35f0975a359fbaa8a86c15a7a264857ce8adffad4e

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    301.6MB

    MD5

    e8848bf14aaf1aa7624d06e721b67dc4

    SHA1

    56944618e0bd5482e440b63b55fb22e882ee6c1e

    SHA256

    59c32eddde3fd25bf432cec2d11e77da3237c448ec2ebcc7df84ea8a4cbe1460

    SHA512

    64464bb2dd400de7f3e5922baaefde6489587b39ed8c760b16739b4f666b8a1bd47f51de1efab113cc75eaa7221ae135bacbde1ef88bf26dcf18336426d23ed0

  • memory/1684-86-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-85-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-84-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-83-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-82-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-81-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-80-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-79-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/1684-78-0x0000000001170000-0x0000000001ABE000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-68-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-76-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-67-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-54-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-69-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-70-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-71-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-65-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-64-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-66-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-77-0x0000000028820000-0x000000002916E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-63-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-62-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-61-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-60-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-59-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-58-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-57-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-56-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB

  • memory/2016-55-0x00000000003D0000-0x0000000000D1E000-memory.dmp

    Filesize

    9.3MB