Analysis
-
max time kernel
275s -
max time network
291s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05-08-2023 03:55
Static task
static1
Behavioral task
behavioral1
Sample
346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe
Resource
win10-20230703-en
General
-
Target
346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe
-
Size
4.4MB
-
MD5
f61e05f96863f1070d3614d2dd6cb4f7
-
SHA1
43aea9068eed04aa2aa44e352e69a5ba9cecc6c7
-
SHA256
346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c
-
SHA512
61477452f661cc0835f3806ee93f5c42057b57a4505dbb6f1f739935c875857f12fb5d48c385e4b8473a075dfd1684bdb695cd0ef3c376e9a6a808fde7df25dc
-
SSDEEP
98304:ZBGu/ztzM5DBhXBXrkUULWWd7PrTgvvQ069Rmu/sKWBGJx:ZB3/V+DBhXVkUULbPcY35/sKWm
Malware Config
Extracted
laplas
http://45.159.189.33
-
api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2588 ntlhost.exe -
Loads dropped DLL 1 IoCs
pid Process 2572 346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2572 346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe 2588 ntlhost.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2588 2572 346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe 28 PID 2572 wrote to memory of 2588 2572 346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe 28 PID 2572 wrote to memory of 2588 2572 346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe"C:\Users\Admin\AppData\Local\Temp\346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
785.4MB
MD5c1929f46d103686b5c7806ea24da6273
SHA17555becf3dc8535dfa894e8a59baaab5b2ba91db
SHA2563aa6c8f08f501119e2a5a9a5d43e3f712f491b2233e34013fa8e8f1919ab216e
SHA51260d3add9da007a6735c9549d938de287ef9be04a484ada41739a6acf9f57a1b1f9c71b7d88578b6eb4e3fe6eaebfa2a4ab9c462f08a3472db5433995605c236f
-
Filesize
785.4MB
MD5c1929f46d103686b5c7806ea24da6273
SHA17555becf3dc8535dfa894e8a59baaab5b2ba91db
SHA2563aa6c8f08f501119e2a5a9a5d43e3f712f491b2233e34013fa8e8f1919ab216e
SHA51260d3add9da007a6735c9549d938de287ef9be04a484ada41739a6acf9f57a1b1f9c71b7d88578b6eb4e3fe6eaebfa2a4ab9c462f08a3472db5433995605c236f