Analysis

  • max time kernel
    271s
  • max time network
    278s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2023 00:26

General

  • Target

    1ed33d760f151b33b3d20bf9e6d0b722fe39cbd302ecebb5c6e3d0ee09e4ee05.exe

  • Size

    2.8MB

  • MD5

    6659f84db9582049c250a8343dbf9168

  • SHA1

    e58b0d6a289be0a12f20587cf8945233a086a27e

  • SHA256

    1ed33d760f151b33b3d20bf9e6d0b722fe39cbd302ecebb5c6e3d0ee09e4ee05

  • SHA512

    f9c54bd609dd78d182652892747b22db4064401dc420677f0f79e93b8504b6b4a1c92dd08d32cd4362b9973a9f7dc577b753b15f0d543b9449f64d41d652607c

  • SSDEEP

    49152:4K9pTJqY0xorwlsQRXh9e3rcpadXRZCq3PPK5/AQEiNT18Nnb+vE:4KLvZrAjX/rdlpLk+8

Malware Config

Extracted

Family

redline

Botnet

250723_rc_11

C2

rcam25.tuktuk.ug:11290

Attributes
  • auth_value

    e4d5022e8271228547a5ac6b68c29a07

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

  • Detects DLL dropped by Raspberry Robin. 1 IoCs

    Raspberry Robin.

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ed33d760f151b33b3d20bf9e6d0b722fe39cbd302ecebb5c6e3d0ee09e4ee05.exe
    "C:\Users\Admin\AppData\Local\Temp\1ed33d760f151b33b3d20bf9e6d0b722fe39cbd302ecebb5c6e3d0ee09e4ee05.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Users\Admin\AppData\Local\Temp\Notepod.exe
        "C:\Users\Admin\AppData\Local\Temp\Notepod.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:1872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    3.1MB

    MD5

    18658dec7775fa53f081b892d6a2b027

    SHA1

    fa8d901c7aac70e2c37544883ce087e48c6302d1

    SHA256

    17ca2de661fa07dd83a55a5005c61eb8aee1e9cab56e9a13bc36a27f4b785554

    SHA512

    cae5c6041b22b507ce66cb3b6509ff692b359748791aa93e006e1a700ff3cd439314823d070ff869ca4aac8fb8c2ac41d8de134bd1802693833b6cec7464f56d

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    3.1MB

    MD5

    18658dec7775fa53f081b892d6a2b027

    SHA1

    fa8d901c7aac70e2c37544883ce087e48c6302d1

    SHA256

    17ca2de661fa07dd83a55a5005c61eb8aee1e9cab56e9a13bc36a27f4b785554

    SHA512

    cae5c6041b22b507ce66cb3b6509ff692b359748791aa93e006e1a700ff3cd439314823d070ff869ca4aac8fb8c2ac41d8de134bd1802693833b6cec7464f56d

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    742.1MB

    MD5

    2d0bf19ec79b0508cb7b51377a0b97ab

    SHA1

    0c3e52529dc41a8bd9bbed8ba64ce4786ed5a1d3

    SHA256

    3021900afa22c1d9c677b4068252cd358c4b0680ffd845c7969f99eb1c5dbd11

    SHA512

    dd633eaa07f9a489ead949349b655a16bf32f5129f75796d90bb5125e9b4a7f5b9f90622bcf53408ac790b5bf6eabcec58c13a437c6dc8ca0714c4f1021b871a

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    742.1MB

    MD5

    2d0bf19ec79b0508cb7b51377a0b97ab

    SHA1

    0c3e52529dc41a8bd9bbed8ba64ce4786ed5a1d3

    SHA256

    3021900afa22c1d9c677b4068252cd358c4b0680ffd845c7969f99eb1c5dbd11

    SHA512

    dd633eaa07f9a489ead949349b655a16bf32f5129f75796d90bb5125e9b4a7f5b9f90622bcf53408ac790b5bf6eabcec58c13a437c6dc8ca0714c4f1021b871a

  • \Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    3.1MB

    MD5

    18658dec7775fa53f081b892d6a2b027

    SHA1

    fa8d901c7aac70e2c37544883ce087e48c6302d1

    SHA256

    17ca2de661fa07dd83a55a5005c61eb8aee1e9cab56e9a13bc36a27f4b785554

    SHA512

    cae5c6041b22b507ce66cb3b6509ff692b359748791aa93e006e1a700ff3cd439314823d070ff869ca4aac8fb8c2ac41d8de134bd1802693833b6cec7464f56d

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    742.1MB

    MD5

    2d0bf19ec79b0508cb7b51377a0b97ab

    SHA1

    0c3e52529dc41a8bd9bbed8ba64ce4786ed5a1d3

    SHA256

    3021900afa22c1d9c677b4068252cd358c4b0680ffd845c7969f99eb1c5dbd11

    SHA512

    dd633eaa07f9a489ead949349b655a16bf32f5129f75796d90bb5125e9b4a7f5b9f90622bcf53408ac790b5bf6eabcec58c13a437c6dc8ca0714c4f1021b871a

  • memory/1872-155-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-165-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-145-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-147-0x0000000077940000-0x0000000077AE9000-memory.dmp

    Filesize

    1.7MB

  • memory/1872-148-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-149-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-150-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-151-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-152-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-153-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-154-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-156-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-157-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-158-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-159-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-160-0x0000000077940000-0x0000000077AE9000-memory.dmp

    Filesize

    1.7MB

  • memory/1872-161-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-162-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-163-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-167-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1872-166-0x0000000000310000-0x0000000000A95000-memory.dmp

    Filesize

    7.5MB

  • memory/1880-80-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-78-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-88-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-90-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-84-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-86-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-108-0x0000000076320000-0x0000000076430000-memory.dmp

    Filesize

    1.1MB

  • memory/1880-109-0x00000000775D0000-0x0000000077617000-memory.dmp

    Filesize

    284KB

  • memory/1880-110-0x0000000000C90000-0x0000000001342000-memory.dmp

    Filesize

    6.7MB

  • memory/1880-63-0x0000000077B30000-0x0000000077B32000-memory.dmp

    Filesize

    8KB

  • memory/1880-82-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-76-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-62-0x00000000775D0000-0x0000000077617000-memory.dmp

    Filesize

    284KB

  • memory/1880-92-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-61-0x0000000076320000-0x0000000076430000-memory.dmp

    Filesize

    1.1MB

  • memory/1880-74-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-54-0x00000000775D0000-0x0000000077617000-memory.dmp

    Filesize

    284KB

  • memory/1880-60-0x0000000076320000-0x0000000076430000-memory.dmp

    Filesize

    1.1MB

  • memory/1880-72-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-70-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-69-0x0000000000500000-0x0000000000515000-memory.dmp

    Filesize

    84KB

  • memory/1880-68-0x0000000000500000-0x000000000051C000-memory.dmp

    Filesize

    112KB

  • memory/1880-65-0x0000000000C90000-0x0000000001342000-memory.dmp

    Filesize

    6.7MB

  • memory/1880-66-0x00000000775D0000-0x0000000077617000-memory.dmp

    Filesize

    284KB

  • memory/1880-64-0x0000000000C90000-0x0000000001342000-memory.dmp

    Filesize

    6.7MB

  • memory/1880-58-0x0000000076320000-0x0000000076430000-memory.dmp

    Filesize

    1.1MB

  • memory/1880-59-0x00000000775D0000-0x0000000077617000-memory.dmp

    Filesize

    284KB

  • memory/1880-53-0x0000000000C90000-0x0000000001342000-memory.dmp

    Filesize

    6.7MB

  • memory/2128-122-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-133-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-134-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-136-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-137-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-138-0x0000000077940000-0x0000000077AE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2128-132-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-131-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-143-0x0000000028610000-0x0000000028D95000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-129-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-130-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-144-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-146-0x0000000077940000-0x0000000077AE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2128-128-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-127-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-126-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-125-0x00000000011A0000-0x0000000001925000-memory.dmp

    Filesize

    7.5MB

  • memory/2128-124-0x0000000077940000-0x0000000077AE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2888-123-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2888-120-0x000000000B900000-0x000000000C085000-memory.dmp

    Filesize

    7.5MB

  • memory/2888-115-0x0000000004A50000-0x0000000004A90000-memory.dmp

    Filesize

    256KB

  • memory/2888-114-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2888-113-0x0000000004A50000-0x0000000004A90000-memory.dmp

    Filesize

    256KB

  • memory/2888-112-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2888-111-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB

  • memory/2888-106-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2888-104-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2888-102-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2888-101-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2888-99-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2888-97-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2888-95-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2888-93-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB