Analysis
-
max time kernel
293s -
max time network
251s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
16-07-2023 01:25
General
-
Target
807f54c88592025c02077930259ed3a4c6a3e216a8d53350bbebcb5c597bab2d.exe
-
Size
5.1MB
-
MD5
2f5fffc7e0e41a5c84b551ce5a423389
-
SHA1
c95e5360ce09ac18d25e89e66c4f51db9cdec43b
-
SHA256
807f54c88592025c02077930259ed3a4c6a3e216a8d53350bbebcb5c597bab2d
-
SHA512
7dba8647e20f929d6debd98f2c6254e5cc54ea3249263df4743d9d6048a5061b9632ca595507e00e7230dd297736b9d5dd2fdfcc4451906793b29edc00f3234a
-
SSDEEP
98304:/cYVGTljIJwztRW8pHTOQLsJrM3zGbIIwWmK3x5z4P0mAZPwCU2WI1L2DV+gbYHZ:/cZTl8JqfXf3FIw44tKI92L2DfbU8i
Malware Config
Extracted
laplas
http://lpls.tuktuk.ug
-
api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\807f54c88592025c02077930259ed3a4c6a3e216a8d53350bbebcb5c597bab2d.exe"C:\Users\Admin\AppData\Local\Temp\807f54c88592025c02077930259ed3a4c6a3e216a8d53350bbebcb5c597bab2d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
711.1MB
MD5e93d8c238a7200421b19d1b92fc8ee26
SHA1ff5c4a66e9275728bf5183d2006bcb2ceed8cf4a
SHA25657720f40d34fa7c16d070450e612bca5a3f3c218b05f048e8417b206bfa4ef0c
SHA5121fce6e72d88ddffdc222271f6496903c633b0e324175d97c1f70f7359f10215914d00e41fa78d0573cf194bde2368dc661adfe84cd60aeb42a9ade9a9c8d7eae
-
Filesize
711.1MB
MD5e93d8c238a7200421b19d1b92fc8ee26
SHA1ff5c4a66e9275728bf5183d2006bcb2ceed8cf4a
SHA25657720f40d34fa7c16d070450e612bca5a3f3c218b05f048e8417b206bfa4ef0c
SHA5121fce6e72d88ddffdc222271f6496903c633b0e324175d97c1f70f7359f10215914d00e41fa78d0573cf194bde2368dc661adfe84cd60aeb42a9ade9a9c8d7eae
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
1.9MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
1.9MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
1.9MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
1.9MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
1.9MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB