Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2023 15:29
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
General
-
Target
tmp.exe
-
Size
3.0MB
-
MD5
02208e4168793ef72942aa31c1ae8642
-
SHA1
449b579d0b642ca43419c0687cc799afe5aa9194
-
SHA256
22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9
-
SHA512
f50be51f1ff3da3da34d4c819021686842d024476993031e56313fde1aded427e9e81d0cb2956c98d29839fac140597a8e1b1cbd89a58c481be70ce88ce5507f
-
SSDEEP
49152:MY5UqJTec/w5ashu/usRTe2WjCJILmGsO8ASotjEH10DwJ4mQDewL11TAjZVwyb:MYUqI5aPXZJIpsr7VrJ4zDHL11byb
Malware Config
Extracted
laplas
http://206.189.229.43
-
api_key
f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
ntlhost.exetmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ntlhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ tmp.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ntlhost.exetmp.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion tmp.exe -
Executes dropped EXE 1 IoCs
Processes:
ntlhost.exepid process 5084 ntlhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" tmp.exe -
Processes:
tmp.exentlhost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ntlhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
tmp.exentlhost.exepid process 2760 tmp.exe 5084 ntlhost.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 35 Go-http-client/1.1 -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
tmp.exedescription pid process target process PID 2760 wrote to memory of 5084 2760 tmp.exe ntlhost.exe PID 2760 wrote to memory of 5084 2760 tmp.exe ntlhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeFilesize
610.9MB
MD508855533f05d849bbec8300e2281de8a
SHA186f83999fe23ba220ed041fca5ad4bd202557d71
SHA25615333940a8ac6fab18c9e2b36b6b3c2cd70e4bb0d93c80acf85cc4d7cbb1357c
SHA512e126935829c6345d82b0e1ebaee8ccefb84e3661c9dd510737e42733814829c3761a78ad28b60d0d1b072930d1910de80b18d8f708a9a35ec3dea33bc4b63790
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeFilesize
610.2MB
MD54c069e3513da98505c0a647054c51b66
SHA1bd0adadca21993bc0599610c4b872d08409e8041
SHA25645f17d93afe056fb3e202b45a72aedec835c495b70a390429fe0ba2a9551ae2e
SHA5128dd410defba3bf89d0b9f83735f1fa31e37d6bd4f9dcc80e55250eea369f45a0c89fdf4e950629ffb0b67575bf4457453cdf3bb9ab9bd1bec32507d35acf39c5
-
memory/2760-0-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-1-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/2760-2-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/2760-3-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/2760-4-0x00007FF9E6F10000-0x00007FF9E7105000-memory.dmpFilesize
2.0MB
-
memory/2760-5-0x00007FF980030000-0x00007FF980031000-memory.dmpFilesize
4KB
-
memory/2760-6-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/2760-7-0x00007FF980000000-0x00007FF980002000-memory.dmpFilesize
8KB
-
memory/2760-8-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-9-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-10-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-11-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-12-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-13-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-14-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-15-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-16-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-18-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-19-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/2760-20-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-21-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/2760-22-0x00007FF9E6F10000-0x00007FF9E7105000-memory.dmpFilesize
2.0MB
-
memory/2760-23-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-27-0x0000000000C70000-0x000000000158D000-memory.dmpFilesize
9.1MB
-
memory/2760-29-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/2760-30-0x00007FF9E6F10000-0x00007FF9E7105000-memory.dmpFilesize
2.0MB
-
memory/5084-28-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-31-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/5084-32-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/5084-33-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/5084-34-0x00007FF9E6F10000-0x00007FF9E7105000-memory.dmpFilesize
2.0MB
-
memory/5084-35-0x00007FF980030000-0x00007FF980031000-memory.dmpFilesize
4KB
-
memory/5084-36-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/5084-37-0x00007FF980000000-0x00007FF980002000-memory.dmpFilesize
8KB
-
memory/5084-38-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-39-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-40-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-41-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-42-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-43-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-44-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-45-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-46-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-47-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-48-0x00007FF9E4630000-0x00007FF9E48F9000-memory.dmpFilesize
2.8MB
-
memory/5084-49-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-50-0x00007FF9E6F10000-0x00007FF9E7105000-memory.dmpFilesize
2.0MB
-
memory/5084-51-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-52-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-53-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-54-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-55-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-56-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-57-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-59-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-60-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-61-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-62-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-63-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB
-
memory/5084-64-0x0000000000A70000-0x000000000138D000-memory.dmpFilesize
9.1MB