Analysis
-
max time kernel
299s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
24-04-2023 22:17
General
-
Target
4b849d412245437a6185de355d24799911f08df34a5c77e265c6b7222e84337a.exe
-
Size
3.1MB
-
MD5
36538f9861e330d5ac9310418f615bf9
-
SHA1
ab32322f5094133b4f75ab10d63a3705cb2064c8
-
SHA256
4b849d412245437a6185de355d24799911f08df34a5c77e265c6b7222e84337a
-
SHA512
9c79444bea20258e71e782ebbdeceb71547f5be54764088f6aba0a0062fce3f8277546bd2f294ae040804196a8e41e99d057449f73d4cbfc4d0213eaa12bdb68
-
SSDEEP
49152:8DOm/UnwYvirEus6NRwMwyfaQb+Tch+kmqk2ls0Oz4HoJ1c0TrBO8THK6aLhlLFq:8xUwiijeMLfRb+Tirdkt0O8Hybrj6HH
Malware Config
Extracted
laplas
http://45.159.189.33
-
api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b849d412245437a6185de355d24799911f08df34a5c77e265c6b7222e84337a.exe"C:\Users\Admin\AppData\Local\Temp\4b849d412245437a6185de355d24799911f08df34a5c77e265c6b7222e84337a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
813.1MB
MD5f8f21df6b794e831ccb19a88b89dbc2f
SHA17107db875679c877135b0e9e70da8a59b284a29a
SHA2569b1616db5e0cee92b3224fe4e12a6e494b78215ff327cd18c42f69e5e88890a5
SHA5121a85754ccdaf2310da2cb92fbdee0829f9eda727cb4d23a88fb0a7bc4b9fa08957b90a57c8d24a607449de1b6bd602404caf363cf88570d87dfcbe2fc6b65246
-
Filesize
813.1MB
MD5f8f21df6b794e831ccb19a88b89dbc2f
SHA17107db875679c877135b0e9e70da8a59b284a29a
SHA2569b1616db5e0cee92b3224fe4e12a6e494b78215ff327cd18c42f69e5e88890a5
SHA5121a85754ccdaf2310da2cb92fbdee0829f9eda727cb4d23a88fb0a7bc4b9fa08957b90a57c8d24a607449de1b6bd602404caf363cf88570d87dfcbe2fc6b65246
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB