Analysis

  • max time kernel
    275s
  • max time network
    285s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22-07-2023 22:13

General

  • Target

    b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe

  • Size

    2.8MB

  • MD5

    4fee4dfe32401be36ab9d2f6e41f6228

  • SHA1

    897fe7fb7242cc6ec4964183141a8f0c7d5f172e

  • SHA256

    b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1

  • SHA512

    cb2f786ab00d7e1484cc977f56daf7e555909fdc7a9da14e0f541ef00b58fb8f78241c4cb79dccbe7d99cb7e772c3791d143346c1e75604e98176c121cb55c18

  • SSDEEP

    49152:uxAUjfZ+AnOsIOyocA+YwZavG/Mfow7HSG5RXE10M97MKcGt6I69DpL9PlIvuyJt:Q9gAnWoR+YMav5oUb5RaBptoJpLjOJcw

Malware Config

Extracted

Family

redline

Botnet

210723_rc_11

C2

rcam21.tuktuk.ug:11290

Attributes
  • auth_value

    dd5c2e37dd240447def77d8a4c6244f5

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe
    "C:\Users\Admin\AppData\Local\Temp\b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Users\Admin\AppData\Local\Temp\Notepod.exe
        "C:\Users\Admin\AppData\Local\Temp\Notepod.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.4MB

    MD5

    24c40e66db640789a022cb839b28d476

    SHA1

    b6000f4b0e71ce952267e7e5728bc4181877c497

    SHA256

    6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f

    SHA512

    481240b66ac8eb61b8a9aa6e22e14abdffba7869695c7b92214029a714b619319d3c50bc640e79bf790de309d5a412f4e0fecabc1082acd52d1984c8c8f8f0cd

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.4MB

    MD5

    24c40e66db640789a022cb839b28d476

    SHA1

    b6000f4b0e71ce952267e7e5728bc4181877c497

    SHA256

    6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f

    SHA512

    481240b66ac8eb61b8a9aa6e22e14abdffba7869695c7b92214029a714b619319d3c50bc640e79bf790de309d5a412f4e0fecabc1082acd52d1984c8c8f8f0cd

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    788.4MB

    MD5

    b2f80e420b206809baaefa982c41484f

    SHA1

    e589152fac517be7a7b9c7e2d8fd8ce3a4d62f09

    SHA256

    2620f1446be0c5ebfd251af404cb93c6d2533dc4ee6b020fdfe6af7d69896583

    SHA512

    338aba49ff5f603c5a0284ddc2af6ee9b6cfe1a0bb733d4f246379e9a71674b40b2ea7f3516f11d57fd5fd44fe765ade9b0e4f614c26c4a902a4ee6d71573a68

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    788.4MB

    MD5

    b2f80e420b206809baaefa982c41484f

    SHA1

    e589152fac517be7a7b9c7e2d8fd8ce3a4d62f09

    SHA256

    2620f1446be0c5ebfd251af404cb93c6d2533dc4ee6b020fdfe6af7d69896583

    SHA512

    338aba49ff5f603c5a0284ddc2af6ee9b6cfe1a0bb733d4f246379e9a71674b40b2ea7f3516f11d57fd5fd44fe765ade9b0e4f614c26c4a902a4ee6d71573a68

  • \Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.4MB

    MD5

    24c40e66db640789a022cb839b28d476

    SHA1

    b6000f4b0e71ce952267e7e5728bc4181877c497

    SHA256

    6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f

    SHA512

    481240b66ac8eb61b8a9aa6e22e14abdffba7869695c7b92214029a714b619319d3c50bc640e79bf790de309d5a412f4e0fecabc1082acd52d1984c8c8f8f0cd

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    788.4MB

    MD5

    b2f80e420b206809baaefa982c41484f

    SHA1

    e589152fac517be7a7b9c7e2d8fd8ce3a4d62f09

    SHA256

    2620f1446be0c5ebfd251af404cb93c6d2533dc4ee6b020fdfe6af7d69896583

    SHA512

    338aba49ff5f603c5a0284ddc2af6ee9b6cfe1a0bb733d4f246379e9a71674b40b2ea7f3516f11d57fd5fd44fe765ade9b0e4f614c26c4a902a4ee6d71573a68

  • memory/2152-154-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-149-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-160-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-159-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-158-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-157-0x0000000077000000-0x00000000771A9000-memory.dmp

    Filesize

    1.7MB

  • memory/2152-156-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-155-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-164-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-153-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-152-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-151-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-150-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-163-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-148-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-147-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-146-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-145-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-144-0x0000000077000000-0x00000000771A9000-memory.dmp

    Filesize

    1.7MB

  • memory/2152-142-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-165-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-166-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-167-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-168-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2152-169-0x0000000001130000-0x0000000001A22000-memory.dmp

    Filesize

    8.9MB

  • memory/2604-86-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-90-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-54-0x0000000076B50000-0x0000000076B97000-memory.dmp

    Filesize

    284KB

  • memory/2604-57-0x0000000076CD0000-0x0000000076DE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2604-58-0x0000000076CD0000-0x0000000076DE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2604-61-0x0000000076CD0000-0x0000000076DE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2604-60-0x0000000076CD0000-0x0000000076DE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2604-110-0x0000000076B50000-0x0000000076B97000-memory.dmp

    Filesize

    284KB

  • memory/2604-109-0x0000000076CD0000-0x0000000076DE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2604-111-0x0000000000F90000-0x0000000001632000-memory.dmp

    Filesize

    6.6MB

  • memory/2604-59-0x0000000076CD0000-0x0000000076DE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2604-63-0x00000000771F0000-0x00000000771F2000-memory.dmp

    Filesize

    8KB

  • memory/2604-62-0x0000000076CD0000-0x0000000076DE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2604-64-0x0000000000F90000-0x0000000001632000-memory.dmp

    Filesize

    6.6MB

  • memory/2604-65-0x0000000000F90000-0x0000000001632000-memory.dmp

    Filesize

    6.6MB

  • memory/2604-66-0x0000000076B50000-0x0000000076B97000-memory.dmp

    Filesize

    284KB

  • memory/2604-68-0x0000000000280000-0x000000000029C000-memory.dmp

    Filesize

    112KB

  • memory/2604-69-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-72-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-70-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-76-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-74-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-80-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-78-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-84-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-82-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-88-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2604-53-0x0000000000F90000-0x0000000001632000-memory.dmp

    Filesize

    6.6MB

  • memory/2604-92-0x0000000000280000-0x0000000000295000-memory.dmp

    Filesize

    84KB

  • memory/2900-94-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2900-120-0x0000000073E10000-0x00000000744FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2900-95-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2900-97-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2900-93-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2900-102-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2900-103-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2900-104-0x0000000073E10000-0x00000000744FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2900-105-0x0000000000580000-0x00000000005C0000-memory.dmp

    Filesize

    256KB

  • memory/2900-107-0x0000000073E10000-0x00000000744FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2900-96-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2900-112-0x0000000000580000-0x00000000005C0000-memory.dmp

    Filesize

    256KB

  • memory/2900-98-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2900-100-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2900-118-0x0000000008D50000-0x0000000009642000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-133-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-119-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-125-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-124-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-123-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-122-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-121-0x0000000077000000-0x00000000771A9000-memory.dmp

    Filesize

    1.7MB

  • memory/3024-127-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-128-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-126-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-129-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-130-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-131-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-136-0x0000000077000000-0x00000000771A9000-memory.dmp

    Filesize

    1.7MB

  • memory/3024-143-0x0000000077000000-0x00000000771A9000-memory.dmp

    Filesize

    1.7MB

  • memory/3024-134-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-140-0x0000000000F90000-0x0000000001882000-memory.dmp

    Filesize

    8.9MB

  • memory/3024-141-0x0000000028920000-0x0000000029212000-memory.dmp

    Filesize

    8.9MB