laplas | 11b80af6cb8bffedc46b7586644a29e9854ec440421926d7acd40e80b5ba08be

General

Target

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Size

10.5MB
MD5

d75c660c2584891aa2072643e345c941
SHA1

cc3ed51870ecd89963428c4d3638c8a99d0ea991
SHA256

11b80af6cb8bffedc46b7586644a29e9854ec440421926d7acd40e80b5ba08be
SHA512

8a9ab5f164b7268ff56529c35bf97dccedff20f822e2a4daabc97e0af7cfd9f31593df440a337e6b9d84db60e5ed0be6f238545f367dada3012c54f4c61bd7d6
SSDEEP

196608:e+la0xOiukoEzn0quVFJ/ODw+lxihvwo:e+s0mDHVFo7Aw

Score

10^/10

laplas bootkit clipper evasion persistence stealer trojan

Malware Config

Extracted

Family

laplas

C2

http://193.233.20.134

Attributes

api_key
57728dce0f7018e17faf9f061cb2d77048e08414376baf6d860b78e74e83c208

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe

Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

668 ntlhost.exe
Loads dropped DLL 1 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

pid process

1712 SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

pid	process
668	ntlhost.exe

pid	process
1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
File opened for modification	\??\PhysicalDrive0	ntlhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

pid process

1712 SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
668 ntlhost.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 2 Go-http-client/1.1
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

pid process

1712 SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
668 ntlhost.exe

pid	process
1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
668	ntlhost.exe

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1

pid	process
1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
668	ntlhost.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

description	pid	process	target process
PID 1712 wrote to memory of 668	1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1712 wrote to memory of 668	1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1712 wrote to memory of 668	1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1712 wrote to memory of 668	1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1712 wrote to memory of 668	1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1712 wrote to memory of 668	1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1712 wrote to memory of 668	1712	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mntemp
Filesize
16B

MD5
8a2d9b289c19e05fd0379b82f2919a21

SHA1
97440fb16a4b8c0ede2d527141749aab76a7a252

SHA256
158fa2d1f60e6330072d181063c9b6d2c2c19fd92b5400f382f7d95bfaec1fec

SHA512
cd553fea1140ebb0231c1ecb618793e6a4746a35129bc7a7c96e066cd17edf0f1fec65ee483784add1c296b06637e4f0ddf1e13c6e9231ec54ee2fc458acd015

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
793.5MB

MD5
c92a31cabbbd2b112204d4ff6d74b13f

SHA1
c576285e7a9b0817e4cfb07d307033066cc4dbce

SHA256
66a49f5c2da4aeca24b4c053f8132ee2665e056cf076ea871c6db6c21b99f8f8

SHA512
f742ce1c4c8fa6c38dbb4de0a558c3b107ff4b373f21715eb416f53f81c7320f679f0cb706eab867ec7187ff744aa199c98a8887ed511c9f53051676662f4a21

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
793.5MB

MD5
c92a31cabbbd2b112204d4ff6d74b13f

SHA1
c576285e7a9b0817e4cfb07d307033066cc4dbce

SHA256
66a49f5c2da4aeca24b4c053f8132ee2665e056cf076ea871c6db6c21b99f8f8

SHA512
f742ce1c4c8fa6c38dbb4de0a558c3b107ff4b373f21715eb416f53f81c7320f679f0cb706eab867ec7187ff744aa199c98a8887ed511c9f53051676662f4a21

Download Submit
memory/668-81-0x0000000001360000-0x0000000002487000-memory.dmp

Filesize
17.2MB

Download
memory/668-101-0x0000000001360000-0x0000000002487000-memory.dmp

Filesize
17.2MB

Download
memory/668-100-0x0000000003890000-0x0000000003C93000-memory.dmp

Filesize
4.0MB

Download
memory/668-99-0x0000000003890000-0x0000000003C93000-memory.dmp

Filesize
4.0MB

Download
memory/668-98-0x0000000003890000-0x0000000003C93000-memory.dmp

Filesize
4.0MB

Download
memory/668-92-0x0000000003890000-0x0000000003C93000-memory.dmp

Filesize
4.0MB

Download
memory/668-85-0x0000000001360000-0x0000000002487000-memory.dmp

Filesize
17.2MB

Download
memory/668-84-0x0000000001360000-0x0000000002487000-memory.dmp

Filesize
17.2MB

Download
memory/668-83-0x0000000001360000-0x0000000002487000-memory.dmp

Filesize
17.2MB

Download
memory/1712-66-0x0000000003900000-0x0000000003D03000-memory.dmp

Filesize
4.0MB

Download
memory/1712-75-0x0000000003900000-0x0000000003D03000-memory.dmp

Filesize
4.0MB

Download
memory/1712-70-0x0000000003900000-0x0000000003D03000-memory.dmp

Filesize
4.0MB

Download
memory/1712-68-0x0000000000B40000-0x0000000001C67000-memory.dmp

Filesize
17.2MB

Download
memory/1712-67-0x0000000003900000-0x0000000003D03000-memory.dmp

Filesize
4.0MB

Download
memory/1712-55-0x0000000000B40000-0x0000000001C67000-memory.dmp

Filesize
17.2MB

Download
memory/1712-65-0x0000000003900000-0x0000000003D03000-memory.dmp

Filesize
4.0MB

Download
memory/1712-59-0x0000000003900000-0x0000000003D03000-memory.dmp

Filesize
4.0MB

Download
memory/1712-57-0x0000000000B40000-0x0000000001C67000-memory.dmp

Filesize
17.2MB

Download
memory/1712-56-0x0000000000B40000-0x0000000001C67000-memory.dmp

Filesize
17.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads