Analysis
-
max time kernel
297s -
max time network
285s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
22-04-2023 23:18
General
-
Target
069cea06b86b712c69a0b18759241f208ef795eaee50ae8e0bdd5a7e75a1c7f5.exe
-
Size
2.8MB
-
MD5
6500da2232915280dd2e80ff34acc12e
-
SHA1
c9338a8d7906fef20ae1450271dc06c7765c88f3
-
SHA256
069cea06b86b712c69a0b18759241f208ef795eaee50ae8e0bdd5a7e75a1c7f5
-
SHA512
1b5e7f2ee005895af14df09343afaee3aebac3a400c8636bc61e19d7232140c73ea7803f98afc5474d5046066d87e3fb6af3894a7fab68b31925227b7c5eae4f
-
SSDEEP
49152:D+xYLpNEA9IVxzAAXAxgYCHJeoSV+yfpyl/RlGzMETVlJvZmx6DhP03iln14Vuzd:D+CGVVxzAAwxgYCk+yfaKzdTVlJRm6hF
Malware Config
Extracted
laplas
http://45.159.189.105
-
api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\069cea06b86b712c69a0b18759241f208ef795eaee50ae8e0bdd5a7e75a1c7f5.exe"C:\Users\Admin\AppData\Local\Temp\069cea06b86b712c69a0b18759241f208ef795eaee50ae8e0bdd5a7e75a1c7f5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
838.8MB
MD5cb0666d57ba7acf3e3c179bec9c78470
SHA1302204b89caa897caf1b94065fa85c0cc608076e
SHA2561bee2749edaa162aeda5d0077ba7eb8585c7c3d31f4c35f4c0060f820a323c35
SHA5123dc1a14247ea64886baa6b43ff842ef9e01e89ebbdaad22980f7edc9b752b43b2e163b1a34fbc4d6f665ed10a7c8a9792b9fdf9aa302d447a746eb6b8a268c47
-
Filesize
838.8MB
MD5cb0666d57ba7acf3e3c179bec9c78470
SHA1302204b89caa897caf1b94065fa85c0cc608076e
SHA2561bee2749edaa162aeda5d0077ba7eb8585c7c3d31f4c35f4c0060f820a323c35
SHA5123dc1a14247ea64886baa6b43ff842ef9e01e89ebbdaad22980f7edc9b752b43b2e163b1a34fbc4d6f665ed10a7c8a9792b9fdf9aa302d447a746eb6b8a268c47
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB