Analysis

  • max time kernel
    117s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    01-08-2023 14:27

General

  • Target

    223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5eexe_JC.exe

  • Size

    2.8MB

  • MD5

    1d156981b23a1531d4e6449c95ec6c9f

  • SHA1

    98c264b55efdd118215190955d3a6372e4497330

  • SHA256

    223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e

  • SHA512

    c2cc592a3b4aef17e1a6882f97e36bc3cc257b6c83b21cc72bd92cf45ff48c5de45c22c34352a10bf3fc66a884dfb8fec007781561be88e9071d6a2433f91a2d

  • SSDEEP

    49152:OS6hBcbHH6ORsof+ZymfCvKa+nxzsA/y8aiPRmN6VLvOjwsDxA:OS+BcHaORvmZJfdxIA/y83PcNcLvSwsi

Malware Config

Extracted

Family

redline

Botnet

300723_rc

C2

rc3007.tuktuk.ug:11290

Attributes
  • auth_value

    ce139e531e6dc9a5397038679a0625d3

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5eexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5eexe_JC.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Users\Admin\AppData\Local\Temp\Notepod.exe
        "C:\Users\Admin\AppData\Local\Temp\Notepod.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.1MB

    MD5

    b30e29bccabab032c27910210d9ccf76

    SHA1

    caa3927738b66c3ecc553943eabedcbbfbe4c0da

    SHA256

    b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2

    SHA512

    ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8

  • C:\Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.1MB

    MD5

    b30e29bccabab032c27910210d9ccf76

    SHA1

    caa3927738b66c3ecc553943eabedcbbfbe4c0da

    SHA256

    b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2

    SHA512

    ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    61.9MB

    MD5

    1e5676f77b996fd6a8927b4d0398ff23

    SHA1

    3b8208c8d5b4abc7bf04631def871e5d34496766

    SHA256

    45236eb7d0905ebb55970293104b821bccf67a55c4ad5e8e8b21b72d497a051b

    SHA512

    d1f5bc7ceb702081738ba0bc3d050e9e17c8d743f275bc3ac2711fe73d37951971ed76a1597c98b0cb1b205787e37fb494e6f4a861d15e2a25abf4bf79007df1

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    63.6MB

    MD5

    5551def12056fd40462b1249399c9366

    SHA1

    7eed68ca127436fd6fbbae1cab5a8df27cdc404d

    SHA256

    0169fa3e464fbf7e7d116d8c10b8a6fdea8421d18671792945b74e375834aab9

    SHA512

    d9c9efd2a0c048a88b2a8c733d57d4216413bc4623b6670cfb3852e8806a25ff79181c8b0bf37c8890ded2172c48512deb16792893523455a001080264f4e8da

  • \Users\Admin\AppData\Local\Temp\Notepod.exe

    Filesize

    4.1MB

    MD5

    b30e29bccabab032c27910210d9ccf76

    SHA1

    caa3927738b66c3ecc553943eabedcbbfbe4c0da

    SHA256

    b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2

    SHA512

    ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    62.8MB

    MD5

    502bea4159626b5bacfd5c26357a9c26

    SHA1

    06606f30f3c5aee514bd48833640b716570e79ea

    SHA256

    9f28605bca758ceb642a54b2cfb98585b8f77207c95e9844f44b684906828595

    SHA512

    aa08156e102d49636fd8a51c1d67748d3c8c243cfbfba8720dc6a35c4a3b03a1776b82fc0efa0678f32732493eb1b62ef0060cec38be1867e0b8e4dacd785746

  • memory/1100-119-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-120-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-113-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-114-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-129-0x00000000770F0000-0x0000000077299000-memory.dmp

    Filesize

    1.7MB

  • memory/1100-115-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-128-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-116-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-117-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-118-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1100-121-0x00000000013D0000-0x0000000001C6B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-133-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-137-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-136-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-135-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-134-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-132-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-130-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-131-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/1988-138-0x0000000000380000-0x0000000000C1B000-memory.dmp

    Filesize

    8.6MB

  • memory/2016-78-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-66-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-55-0x0000000075B20000-0x0000000075C30000-memory.dmp

    Filesize

    1.1MB

  • memory/2016-104-0x0000000075B20000-0x0000000075C30000-memory.dmp

    Filesize

    1.1MB

  • memory/2016-105-0x0000000075CA0000-0x0000000075CE7000-memory.dmp

    Filesize

    284KB

  • memory/2016-106-0x0000000000010000-0x00000000006B4000-memory.dmp

    Filesize

    6.6MB

  • memory/2016-56-0x0000000075B20000-0x0000000075C30000-memory.dmp

    Filesize

    1.1MB

  • memory/2016-57-0x0000000075B20000-0x0000000075C30000-memory.dmp

    Filesize

    1.1MB

  • memory/2016-59-0x0000000075B20000-0x0000000075C30000-memory.dmp

    Filesize

    1.1MB

  • memory/2016-62-0x0000000075CA0000-0x0000000075CE7000-memory.dmp

    Filesize

    284KB

  • memory/2016-63-0x0000000000010000-0x00000000006B4000-memory.dmp

    Filesize

    6.6MB

  • memory/2016-64-0x0000000000930000-0x000000000094C000-memory.dmp

    Filesize

    112KB

  • memory/2016-65-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-88-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-86-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-84-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-82-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-80-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-54-0x0000000000010000-0x00000000006B4000-memory.dmp

    Filesize

    6.6MB

  • memory/2016-68-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-76-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-74-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-72-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2016-70-0x0000000000930000-0x0000000000945000-memory.dmp

    Filesize

    84KB

  • memory/2836-123-0x00000000730A0000-0x000000007378E000-memory.dmp

    Filesize

    6.9MB

  • memory/2836-100-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2836-89-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2836-91-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2836-93-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2836-95-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2836-97-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2836-98-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2836-107-0x00000000003D0000-0x00000000003D6000-memory.dmp

    Filesize

    24KB

  • memory/2836-103-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB