Analysis
-
max time kernel
291s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
21-04-2023 22:24
General
-
Target
e1290a9463ef7d1d61645b7d3fd3e4a7518023091f85ab4085308f70d437707f.exe
-
Size
3.0MB
-
MD5
e81570d802d26df3dde953770c8c9766
-
SHA1
d8df423343b59f8b53f10722b023622477e5fb31
-
SHA256
e1290a9463ef7d1d61645b7d3fd3e4a7518023091f85ab4085308f70d437707f
-
SHA512
1d03bc26a97b4eb680fe9d1996c525e086f6efcb40db2946e7297544a85cd0b6999ac03ed11048dc424631a643ba95a0624865351e86fb76ebc61641c73b7778
-
SSDEEP
98304:XWrcYe0Hec7sl5cWF4bMQDZSQav8CzmU+z:5YQ7vcWOxSQasJz
Malware Config
Extracted
laplas
http://89.23.97.128
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1290a9463ef7d1d61645b7d3fd3e4a7518023091f85ab4085308f70d437707f.exe"C:\Users\Admin\AppData\Local\Temp\e1290a9463ef7d1d61645b7d3fd3e4a7518023091f85ab4085308f70d437707f.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744.0MB
MD5a80a2b7e649248ceb5a505d1bc511fa0
SHA13bc4ee095eb93d36f153424684da479cb66a9cb2
SHA25618a2a35e34bded68dea0a1479f2d6721fd66e5630ede4a4b6e21b303fbdaf76c
SHA512af5be869545d4777b27264330aff0b0a27b3908da5e8b5c49f470cf02f999cbb33f03eaf72f5b5b67c18b9847dc529674860863c259385d16c4c7a789c5d9117
-
Filesize
744.0MB
MD5a80a2b7e649248ceb5a505d1bc511fa0
SHA13bc4ee095eb93d36f153424684da479cb66a9cb2
SHA25618a2a35e34bded68dea0a1479f2d6721fd66e5630ede4a4b6e21b303fbdaf76c
SHA512af5be869545d4777b27264330aff0b0a27b3908da5e8b5c49f470cf02f999cbb33f03eaf72f5b5b67c18b9847dc529674860863c259385d16c4c7a789c5d9117
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB