Behavioral task
behavioral1
Sample
2044-59-0x00000000031D0000-0x00000000035D3000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2044-59-0x00000000031D0000-0x00000000035D3000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2044-59-0x00000000031D0000-0x00000000035D3000-memory.dmp
-
Size
4.0MB
-
MD5
b3ea9c9cb9ff74d397b62fb89b161613
-
SHA1
adc069a9bffcb1c178d026bcb408bd326b7bc393
-
SHA256
bffa1c785fab0914dd9b8b4fbdb7faa3a34ea4e5352e0c94fc29e1d72c1bba8e
-
SHA512
bf4586170e2cad217942e48799ffa63a70d57a11372849d1d45c098e664f3cb80c96b948fd14c236c6f56665c5c72c5df8d655b01e92a8ab0dc1fb25502f34d7
-
SSDEEP
49152:56N8BICR7NWm8qpHXALjaQjiBDo+IPF5pDRXEmb0VF1BL:56NB/aa+upDRXOL
Malware Config
Extracted
laplas
http://194.15.216.30
-
api_key
57728dce0f7018e17faf9f061cb2d77048e08414376baf6d860b78e74e83c208
Signatures
-
Laplas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2044-59-0x00000000031D0000-0x00000000035D3000-memory.dmp
Files
-
2044-59-0x00000000031D0000-0x00000000035D3000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 213KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 988B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ