Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2023, 13:06

General

  • Target

    46ef6daecec030061841713f7.exe

  • Size

    2.6MB

  • MD5

    65482e3a11dff25a26f8b9667999ae5f

  • SHA1

    967455baa933e5122008db83ebf0f0be29d8afa1

  • SHA256

    46ef6daecec030061841713f7afb387a0a7ce913e2a5d63bc46126628daf19e1

  • SHA512

    d4475480c623ddf2a648977af78548470a56e115990018fc91b354b939949a36f7dd84822d4dee54c3a9df690b4d70deef43eb55420f38fe9186a9d26fd1c6b3

  • SSDEEP

    49152:DLZTeIJtQrmRw7mGRPsIbGHH04cmjloa2TouNMjTuyRQeWhKIjAkSt80rY:D5IrmRwKGSTHtjWa2cbTuySeWhKCSvY

Malware Config

Extracted

Family

redline

Botnet

090723_rc_11

C2

rcam.tuktuk.ug:11290

Attributes
  • auth_value

    abd581cdd66d51ad306682319cafa5a0

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46ef6daecec030061841713f7.exe
    "C:\Users\Admin\AppData\Local\Temp\46ef6daecec030061841713f7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\chrome.exe
        "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4752

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\chrome.exe

    Filesize

    4.4MB

    MD5

    f2e100f576b44fdb37d874db2e48085c

    SHA1

    23091a0b5231d69d85866fede573b25577e20414

    SHA256

    77530f67cff4fc2456c0b27abf28d1ab1f4f10fd9be039783adfa25ed1f7f196

    SHA512

    14bd861a48f201a195d322e4c00f758996d2be8b6d78a1c927af53a00e029e9be7db4002c48a80f88d2869e9ba412724ec7a47c8da09faf79133df2edc608f85

  • C:\Users\Admin\AppData\Local\Temp\chrome.exe

    Filesize

    4.4MB

    MD5

    f2e100f576b44fdb37d874db2e48085c

    SHA1

    23091a0b5231d69d85866fede573b25577e20414

    SHA256

    77530f67cff4fc2456c0b27abf28d1ab1f4f10fd9be039783adfa25ed1f7f196

    SHA512

    14bd861a48f201a195d322e4c00f758996d2be8b6d78a1c927af53a00e029e9be7db4002c48a80f88d2869e9ba412724ec7a47c8da09faf79133df2edc608f85

  • C:\Users\Admin\AppData\Local\Temp\chrome.exe

    Filesize

    4.4MB

    MD5

    f2e100f576b44fdb37d874db2e48085c

    SHA1

    23091a0b5231d69d85866fede573b25577e20414

    SHA256

    77530f67cff4fc2456c0b27abf28d1ab1f4f10fd9be039783adfa25ed1f7f196

    SHA512

    14bd861a48f201a195d322e4c00f758996d2be8b6d78a1c927af53a00e029e9be7db4002c48a80f88d2869e9ba412724ec7a47c8da09faf79133df2edc608f85

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    356.0MB

    MD5

    1f54e94f119e14797394e37656199d67

    SHA1

    ca1bfd40d022627866eb53603496361d952120c4

    SHA256

    c92a96a68d191bec6aa58a073e4220382f7f01bf3594520308cc45d6c6a2da43

    SHA512

    5fb68944b7a2fc30e080d1aaa85bb24796871311b002be463dd7e3781b225f2e75a18ca96151a54b6622e96ad5c9296ff0a2a12a74a879d21006449210b16744

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    363.7MB

    MD5

    a6dbc44fe4d8ef109421c854efe3da2d

    SHA1

    a3833d3e115c4f9fb56ed34031e9fd8f8cc75ece

    SHA256

    4d784dc298750d618beb6522abeb6eecad78e02a80a1abcd6c414d8d016984ca

    SHA512

    7b4d43edfa4f187a18ee63bfc88582dc3e6086f46d9a3ac36668ed89977f4da67ceebbe524b813938fe9e579f9afb1b38208cf16f665cb3b0fa3033730e8d8bf

  • memory/2744-171-0x000000000A9A0000-0x000000000A9B2000-memory.dmp

    Filesize

    72KB

  • memory/2744-180-0x000000000A1E0000-0x000000000A70C000-memory.dmp

    Filesize

    5.2MB

  • memory/2744-178-0x000000000B6A0000-0x000000000B706000-memory.dmp

    Filesize

    408KB

  • memory/2744-177-0x0000000005480000-0x0000000005490000-memory.dmp

    Filesize

    64KB

  • memory/2744-176-0x000000000BB00000-0x000000000C0A4000-memory.dmp

    Filesize

    5.6MB

  • memory/2744-175-0x000000000AE50000-0x000000000AEE2000-memory.dmp

    Filesize

    584KB

  • memory/2744-174-0x000000000AD30000-0x000000000ADA6000-memory.dmp

    Filesize

    472KB

  • memory/2744-173-0x0000000005480000-0x0000000005490000-memory.dmp

    Filesize

    64KB

  • memory/2744-172-0x000000000AA00000-0x000000000AA3C000-memory.dmp

    Filesize

    240KB

  • memory/2744-179-0x0000000009AE0000-0x0000000009CA2000-memory.dmp

    Filesize

    1.8MB

  • memory/2744-170-0x000000000AA60000-0x000000000AB6A000-memory.dmp

    Filesize

    1.0MB

  • memory/2744-169-0x000000000AF30000-0x000000000B548000-memory.dmp

    Filesize

    6.1MB

  • memory/2744-165-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/3684-195-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-207-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-203-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-202-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-194-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-193-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-200-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-196-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-197-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-198-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3684-199-0x00000000009E0000-0x0000000001335000-memory.dmp

    Filesize

    9.3MB

  • memory/3896-162-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-168-0x0000000000300000-0x000000000094A000-memory.dmp

    Filesize

    6.3MB

  • memory/3896-164-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-133-0x0000000000300000-0x000000000094A000-memory.dmp

    Filesize

    6.3MB

  • memory/3896-160-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-158-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-156-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-154-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-152-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-150-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-148-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-146-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-144-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-142-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-141-0x0000000000E90000-0x0000000000EA5000-memory.dmp

    Filesize

    84KB

  • memory/3896-140-0x0000000000300000-0x000000000094A000-memory.dmp

    Filesize

    6.3MB

  • memory/3896-138-0x0000000005300000-0x000000000539C000-memory.dmp

    Filesize

    624KB

  • memory/3896-137-0x0000000000300000-0x000000000094A000-memory.dmp

    Filesize

    6.3MB

  • memory/4752-209-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-217-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-210-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-211-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-212-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-213-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-214-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-215-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-216-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-208-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-218-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-219-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-221-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-222-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-223-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-224-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-225-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-226-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB

  • memory/4752-227-0x0000000000F50000-0x00000000018A5000-memory.dmp

    Filesize

    9.3MB