Analysis
-
max time kernel
274s -
max time network
295s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
18-07-2023 04:01
General
-
Target
b20d74c759e6d677148c3cf1ddac1056631d69ec738f098d2c8103782d8d82c6.exe
-
Size
4.0MB
-
MD5
e1cd1c30f4761a2bf4c878ef0a723435
-
SHA1
8fe5aaf4f0906bbc33c73819fd27eb838cc096e0
-
SHA256
b20d74c759e6d677148c3cf1ddac1056631d69ec738f098d2c8103782d8d82c6
-
SHA512
ecf459342f3d6aa775fa471e9b80d457a8a6bdaae18ffe0495fb044c1a665bd6efcfe9fbf27f8e977939797b1caff468e3b5e2a41b433f080e7b63c7fc8d32d8
-
SSDEEP
98304:jBFr1GYY6ihQXeuhAgNcpdWK07pWUd/nwdAS:1/7kdEQUd/nwuS
Malware Config
Extracted
laplas
http://lpls.tuktuk.ug
-
api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b20d74c759e6d677148c3cf1ddac1056631d69ec738f098d2c8103782d8d82c6.exe"C:\Users\Admin\AppData\Local\Temp\b20d74c759e6d677148c3cf1ddac1056631d69ec738f098d2c8103782d8d82c6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764.0MB
MD53f48067d70bebca8bc9f954d3343293d
SHA175d3328666b02d68573d663c2bb9a2363bb9c7ba
SHA25692ee0d361441dfe80ee30c10060b158c67753be25c814292fc73650c22d0c4bc
SHA512932ff2acca875b89faab87ae1ed1488f46ad0bb2840c1beb9cb1c5bd39e074d587b86c4e9f51cf52f951c16b7184c86cacf42469331091e1b4db951f1d4f1319
-
Filesize
764.0MB
MD53f48067d70bebca8bc9f954d3343293d
SHA175d3328666b02d68573d663c2bb9a2363bb9c7ba
SHA25692ee0d361441dfe80ee30c10060b158c67753be25c814292fc73650c22d0c4bc
SHA512932ff2acca875b89faab87ae1ed1488f46ad0bb2840c1beb9cb1c5bd39e074d587b86c4e9f51cf52f951c16b7184c86cacf42469331091e1b4db951f1d4f1319
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
1.7MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
1.7MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
1.7MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
1.7MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
1.7MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB