Analysis

  • max time kernel
    290s
  • max time network
    257s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22-07-2023 22:13

General

  • Target

    b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe

  • Size

    2.8MB

  • MD5

    4fee4dfe32401be36ab9d2f6e41f6228

  • SHA1

    897fe7fb7242cc6ec4964183141a8f0c7d5f172e

  • SHA256

    b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1

  • SHA512

    cb2f786ab00d7e1484cc977f56daf7e555909fdc7a9da14e0f541ef00b58fb8f78241c4cb79dccbe7d99cb7e772c3791d143346c1e75604e98176c121cb55c18

  • SSDEEP

    49152:uxAUjfZ+AnOsIOyocA+YwZavG/Mfow7HSG5RXE10M97MKcGt6I69DpL9PlIvuyJt:Q9gAnWoR+YMav5oUb5RaBptoJpLjOJcw

Malware Config

Extracted

Family

redline

Botnet

210723_rc_11

C2

rcam21.tuktuk.ug:11290

Attributes
  • auth_value

    dd5c2e37dd240447def77d8a4c6244f5

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe
    "C:\Users\Admin\AppData\Local\Temp\b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Users\Admin\AppData\Local\Temp\Notepod.exe
        "C:\Users\Admin\AppData\Local\Temp\Notepod.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:3608
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:1564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.4MB

    MD5

    24c40e66db640789a022cb839b28d476

    SHA1

    b6000f4b0e71ce952267e7e5728bc4181877c497

    SHA256

    6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f

    SHA512

    481240b66ac8eb61b8a9aa6e22e14abdffba7869695c7b92214029a714b619319d3c50bc640e79bf790de309d5a412f4e0fecabc1082acd52d1984c8c8f8f0cd

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.4MB

    MD5

    24c40e66db640789a022cb839b28d476

    SHA1

    b6000f4b0e71ce952267e7e5728bc4181877c497

    SHA256

    6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f

    SHA512

    481240b66ac8eb61b8a9aa6e22e14abdffba7869695c7b92214029a714b619319d3c50bc640e79bf790de309d5a412f4e0fecabc1082acd52d1984c8c8f8f0cd

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    719.4MB

    MD5

    7a897f318ee0b8449fe6f81f7a8e1dd1

    SHA1

    31fa4307be080fc3280ce70835ff7b1489908994

    SHA256

    23265c2ba40ee16cd9b2433e748ec084077a1369ddd5a891d0765012bc103b90

    SHA512

    4808ea68c67abf9b8e17326ffa553c8634e47d77b9d80f8c09e651cc3f7b82b294912995332c1b8ca4f61c5fd6e5f6d4c3c8ed16044742131bc65da00f5537a9

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    719.4MB

    MD5

    7a897f318ee0b8449fe6f81f7a8e1dd1

    SHA1

    31fa4307be080fc3280ce70835ff7b1489908994

    SHA256

    23265c2ba40ee16cd9b2433e748ec084077a1369ddd5a891d0765012bc103b90

    SHA512

    4808ea68c67abf9b8e17326ffa553c8634e47d77b9d80f8c09e651cc3f7b82b294912995332c1b8ca4f61c5fd6e5f6d4c3c8ed16044742131bc65da00f5537a9

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    719.4MB

    MD5

    7a897f318ee0b8449fe6f81f7a8e1dd1

    SHA1

    31fa4307be080fc3280ce70835ff7b1489908994

    SHA256

    23265c2ba40ee16cd9b2433e748ec084077a1369ddd5a891d0765012bc103b90

    SHA512

    4808ea68c67abf9b8e17326ffa553c8634e47d77b9d80f8c09e651cc3f7b82b294912995332c1b8ca4f61c5fd6e5f6d4c3c8ed16044742131bc65da00f5537a9

  • memory/960-185-0x000000000A9F0000-0x000000000AEEE000-memory.dmp

    Filesize

    5.0MB

  • memory/960-595-0x0000000074010000-0x00000000746FE000-memory.dmp

    Filesize

    6.9MB

  • memory/960-467-0x000000000CF30000-0x000000000D0F2000-memory.dmp

    Filesize

    1.8MB

  • memory/960-198-0x00000000092B0000-0x00000000092C0000-memory.dmp

    Filesize

    64KB

  • memory/960-188-0x0000000074010000-0x00000000746FE000-memory.dmp

    Filesize

    6.9MB

  • memory/960-165-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/960-184-0x00000000096C0000-0x0000000009726000-memory.dmp

    Filesize

    408KB

  • memory/960-183-0x0000000009760000-0x00000000097F2000-memory.dmp

    Filesize

    584KB

  • memory/960-182-0x0000000009640000-0x00000000096B6000-memory.dmp

    Filesize

    472KB

  • memory/960-468-0x000000000D630000-0x000000000DB5C000-memory.dmp

    Filesize

    5.2MB

  • memory/960-176-0x0000000009360000-0x00000000093AB000-memory.dmp

    Filesize

    300KB

  • memory/960-175-0x0000000009320000-0x000000000935E000-memory.dmp

    Filesize

    248KB

  • memory/960-173-0x00000000092B0000-0x00000000092C0000-memory.dmp

    Filesize

    64KB

  • memory/960-174-0x00000000092C0000-0x00000000092D2000-memory.dmp

    Filesize

    72KB

  • memory/960-172-0x00000000093D0000-0x00000000094DA000-memory.dmp

    Filesize

    1.0MB

  • memory/960-171-0x00000000098D0000-0x0000000009ED6000-memory.dmp

    Filesize

    6.0MB

  • memory/960-170-0x0000000074010000-0x00000000746FE000-memory.dmp

    Filesize

    6.9MB

  • memory/960-169-0x0000000006C20000-0x0000000006C26000-memory.dmp

    Filesize

    24KB

  • memory/1564-637-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-641-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-626-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-625-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-624-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-623-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-628-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-629-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-630-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-631-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-632-0x00007FFE13550000-0x00007FFE1372B000-memory.dmp

    Filesize

    1.9MB

  • memory/1564-633-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-634-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-635-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-636-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-638-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-640-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-627-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-642-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-643-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-622-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-620-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-619-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-644-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-645-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-646-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-647-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-648-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-618-0x00007FFE13550000-0x00007FFE1372B000-memory.dmp

    Filesize

    1.9MB

  • memory/1564-649-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-616-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-650-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/1564-651-0x00000000009B0000-0x00000000012A2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-592-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-600-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-601-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-602-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-603-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-604-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-605-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-606-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-608-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-609-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-610-0x00007FFE13550000-0x00007FFE1372B000-memory.dmp

    Filesize

    1.9MB

  • memory/3608-611-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-599-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-598-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-597-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-596-0x00007FFE13550000-0x00007FFE1372B000-memory.dmp

    Filesize

    1.9MB

  • memory/3608-615-0x00000000003E0000-0x0000000000CD2000-memory.dmp

    Filesize

    8.9MB

  • memory/3608-617-0x00007FFE13550000-0x00007FFE1372B000-memory.dmp

    Filesize

    1.9MB

  • memory/4896-122-0x00000000001D0000-0x0000000000872000-memory.dmp

    Filesize

    6.6MB

  • memory/4896-197-0x00000000748C0000-0x0000000074A82000-memory.dmp

    Filesize

    1.8MB

  • memory/4896-196-0x00000000001D0000-0x0000000000872000-memory.dmp

    Filesize

    6.6MB

  • memory/4896-195-0x0000000075900000-0x00000000759D0000-memory.dmp

    Filesize

    832KB

  • memory/4896-164-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-162-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-160-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-158-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-156-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-154-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-152-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-150-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-148-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-146-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-144-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-142-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-141-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

    Filesize

    84KB

  • memory/4896-140-0x0000000002AC0000-0x0000000002ADC000-memory.dmp

    Filesize

    112KB

  • memory/4896-139-0x0000000075900000-0x00000000759D0000-memory.dmp

    Filesize

    832KB

  • memory/4896-138-0x0000000075900000-0x00000000759D0000-memory.dmp

    Filesize

    832KB

  • memory/4896-136-0x00000000748C0000-0x0000000074A82000-memory.dmp

    Filesize

    1.8MB

  • memory/4896-135-0x0000000075900000-0x00000000759D0000-memory.dmp

    Filesize

    832KB

  • memory/4896-134-0x00000000001D0000-0x0000000000872000-memory.dmp

    Filesize

    6.6MB

  • memory/4896-133-0x0000000005210000-0x00000000052AC000-memory.dmp

    Filesize

    624KB

  • memory/4896-132-0x00000000001D0000-0x0000000000872000-memory.dmp

    Filesize

    6.6MB

  • memory/4896-129-0x00000000748C0000-0x0000000074A82000-memory.dmp

    Filesize

    1.8MB

  • memory/4896-128-0x0000000075900000-0x00000000759D0000-memory.dmp

    Filesize

    832KB

  • memory/4896-127-0x0000000075900000-0x00000000759D0000-memory.dmp

    Filesize

    832KB

  • memory/4896-126-0x00000000748C0000-0x0000000074A82000-memory.dmp

    Filesize

    1.8MB

  • memory/4896-125-0x00000000748C0000-0x0000000074A82000-memory.dmp

    Filesize

    1.8MB

  • memory/4896-124-0x00000000748C0000-0x0000000074A82000-memory.dmp

    Filesize

    1.8MB

  • memory/4896-123-0x0000000075900000-0x00000000759D0000-memory.dmp

    Filesize

    832KB