laplas | 59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7

General

Target

crona.exe
Size

3.7MB
MD5

ccf4763882256111f713d881ad7d9aa9
SHA1

507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1
SHA256

59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7
SHA512

53d20ba5739d1205be1b16966d981881ea8c9b0b8c9880b1e407f354e025b6ccae61e653b78d6a9e3d9c5023ff09143b365545c411809b645ac24f8620580416
SSDEEP

98304:o+bU8AtKpng3RiQT0Q9zc7J7MRNCwZMGzcf+UctPK0:o+bUVtKxg3RiQ7z0J7MuwDzcGUck

Score

10^/10

laplas clipper evasion persistence stealer trojan

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes

api_key
7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	crona.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	crona.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	crona.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe

Executes dropped EXE 1 IoCs

pid	Process
268	ntlhost.exe

Loads dropped DLL 1 IoCs

pid	Process
1636	crona.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	crona.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	crona.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1636	crona.exe
268	ntlhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 268	1636	crona.exe	27
PID 1636 wrote to memory of 268	1636	crona.exe	27
PID 1636 wrote to memory of 268	1636	crona.exe	27

C:\Users\Admin\AppData\Local\Temp\crona.exe
"C:\Users\Admin\AppData\Local\Temp\crona.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
728.7MB

MD5
9e22ae7c1a01ed314326d2646d6c5816

SHA1
0819115dbf3c71c9bdc4f1737aeced6265d8b153

SHA256
df8a5849453c6a4a0bbe77242a693e4204797d371dd4099c80e34a53519fa74d

SHA512
d4e157c1964609b927a46cc6d5123664f69a164a6b10cd8e04adabdadd96c30a5813d961e63df139a3ff4f6ce9cfe57c665a0e1d506136f014de699305e29020

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
728.7MB

MD5
9e22ae7c1a01ed314326d2646d6c5816

SHA1
0819115dbf3c71c9bdc4f1737aeced6265d8b153

SHA256
df8a5849453c6a4a0bbe77242a693e4204797d371dd4099c80e34a53519fa74d

SHA512
d4e157c1964609b927a46cc6d5123664f69a164a6b10cd8e04adabdadd96c30a5813d961e63df139a3ff4f6ce9cfe57c665a0e1d506136f014de699305e29020

Download Submit
memory/268-71-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-83-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-73-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-89-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-74-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-88-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-87-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-86-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-67-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-68-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-69-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-75-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-85-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-72-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-84-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-82-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-70-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-76-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-77-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-78-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/268-81-0x00000000008F0000-0x000000000113C000-memory.dmp

Filesize
8.3MB

Download
memory/1636-60-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download
memory/1636-58-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download
memory/1636-59-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download
memory/1636-54-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download
memory/1636-66-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download
memory/1636-55-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download
memory/1636-56-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download
memory/1636-61-0x0000000000370000-0x0000000000BBC000-memory.dmp

Filesize
8.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads