laplas | 11b80af6cb8bffedc46b7586644a29e9854ec440421926d7acd40e80b5ba08be

General

Target

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Size

10.5MB
MD5

d75c660c2584891aa2072643e345c941
SHA1

cc3ed51870ecd89963428c4d3638c8a99d0ea991
SHA256

11b80af6cb8bffedc46b7586644a29e9854ec440421926d7acd40e80b5ba08be
SHA512

8a9ab5f164b7268ff56529c35bf97dccedff20f822e2a4daabc97e0af7cfd9f31593df440a337e6b9d84db60e5ed0be6f238545f367dada3012c54f4c61bd7d6
SSDEEP

196608:e+la0xOiukoEzn0quVFJ/ODw+lxihvwo:e+s0mDHVFo7Aw

Score

10^/10

laplas bootkit clipper evasion persistence stealer trojan

Malware Config

Extracted

Family

laplas

C2

http://193.233.20.134

Attributes

api_key
57728dce0f7018e17faf9f061cb2d77048e08414376baf6d860b78e74e83c208

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ntlhost.exeSecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe

Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

2840 ntlhost.exe

pid	process
2840	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

ntlhost.exeSecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	ntlhost.exe
File opened for modification	\??\PhysicalDrive0	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

pid process

1392 SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
2840 ntlhost.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 52 Go-http-client/1.1

description	flow	ioc
HTTP User-Agent header	52	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exentlhost.exe

pid	process
1392	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
1392	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
2840	ntlhost.exe
2840	ntlhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe

description	pid	process	target process
PID 1392 wrote to memory of 2840	1392	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1392 wrote to memory of 2840	1392	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe
PID 1392 wrote to memory of 2840	1392	SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.65917257.29161.485.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mntemp
Filesize
16B

MD5
8a2d9b289c19e05fd0379b82f2919a21

SHA1
97440fb16a4b8c0ede2d527141749aab76a7a252

SHA256
158fa2d1f60e6330072d181063c9b6d2c2c19fd92b5400f382f7d95bfaec1fec

SHA512
cd553fea1140ebb0231c1ecb618793e6a4746a35129bc7a7c96e066cd17edf0f1fec65ee483784add1c296b06637e4f0ddf1e13c6e9231ec54ee2fc458acd015

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
732.2MB

MD5
ab4d05092b44484c8e75e6e806bf7a4e

SHA1
0a23399636507c397ffb01443e8376cdd97a5081

SHA256
fc589b446371a865e6a1f98956a27a0f6bcca3c752df59d52ac6f8970e5a132b

SHA512
68fe483af68b764b9f77eed5542781403578cc7334fa8da17b1eb57ce00af063baa499e81c1f6f094b4db7473c04589f635d731d311e503d800659ac60540f0c

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
702.3MB

MD5
da436a753198d99a6f0af6b8859f797d

SHA1
e0ab79fe30919f50a770ebec16ebe4af30b224d9

SHA256
85ce23cabaff4126daa661eb027abf275fa1c3f3b1822f5f1323f403f1a02b6a

SHA512
1e2735cc718f325d38ac00ad8b9009e21cdc34dcbe2ec1c7f6517dcf7fdbf97e3c69a00f9af8b9bfc1ef661cb0718603629e95f72b40c988bcedce87b430ee3c

Download Submit
memory/1392-154-0x0000000003F60000-0x0000000004363000-memory.dmp

Filesize
4.0MB

Download
memory/1392-136-0x0000000000770000-0x0000000001897000-memory.dmp

Filesize
17.2MB

Download
memory/1392-145-0x0000000003F60000-0x0000000004363000-memory.dmp

Filesize
4.0MB

Download
memory/1392-146-0x0000000003F60000-0x0000000004363000-memory.dmp

Filesize
4.0MB

Download
memory/1392-147-0x0000000003F60000-0x0000000004363000-memory.dmp

Filesize
4.0MB

Download
memory/1392-148-0x0000000003F60000-0x0000000004363000-memory.dmp

Filesize
4.0MB

Download
memory/1392-149-0x0000000000770000-0x0000000001897000-memory.dmp

Filesize
17.2MB

Download
memory/1392-133-0x0000000000770000-0x0000000001897000-memory.dmp

Filesize
17.2MB

Download
memory/1392-137-0x0000000000770000-0x0000000001897000-memory.dmp

Filesize
17.2MB

Download
memory/1392-139-0x0000000003F60000-0x0000000004363000-memory.dmp

Filesize
4.0MB

Download
memory/1392-135-0x0000000000770000-0x0000000001897000-memory.dmp

Filesize
17.2MB

Download
memory/2840-157-0x0000000000990000-0x0000000001AB7000-memory.dmp

Filesize
17.2MB

Download
memory/2840-161-0x0000000000990000-0x0000000001AB7000-memory.dmp

Filesize
17.2MB

Download
memory/2840-162-0x0000000000990000-0x0000000001AB7000-memory.dmp

Filesize
17.2MB

Download
memory/2840-163-0x0000000000990000-0x0000000001AB7000-memory.dmp

Filesize
17.2MB

Download
memory/2840-166-0x0000000004150000-0x0000000004553000-memory.dmp

Filesize
4.0MB

Download
memory/2840-172-0x0000000004150000-0x0000000004553000-memory.dmp

Filesize
4.0MB

Download
memory/2840-173-0x0000000004150000-0x0000000004553000-memory.dmp

Filesize
4.0MB

Download
memory/2840-174-0x0000000004150000-0x0000000004553000-memory.dmp

Filesize
4.0MB

Download
memory/2840-175-0x0000000000990000-0x0000000001AB7000-memory.dmp

Filesize
17.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads