laplas | 4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe
Size

4.6MB
MD5

44e4af2a42e0709726bc55c48755b6c6
SHA1

f30667ab145f876ed67f3568771c9f44cbb075c8
SHA256

4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4
SHA512

ce98088c7ef0c6ba4e0d0acade13eca5d7dfbfea572c805bc28b26c5cb86889b0d19fdd0e194dd80398c1a4734c201045d63b406bf102f9ff10b94bef8929844
SSDEEP

98304:N5QHGBGgZ9TeexEgENstZK0ZqjFOrbKSNm0rkR2U1PZGP0AeZ3o20SlC4W6+EhAG:NO8DZ9TePgEwPZ+OHHrLU1xI0AeZ4ClR

Score

10^/10

laplas clipper evasion persistence stealer trojan

Malware Config

Extracted

Family

laplas

http://lpls.tuktuk.ug

Attributes

api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe

Executes dropped EXE 1 IoCs

pid	Process
1340	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1220	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe
1340	ntlhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	52	Go-http-client/1.1

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1340	1220	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe	94
PID 1220 wrote to memory of 1340	1220	4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe	94

C:\Users\Admin\AppData\Local\Temp\4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe
"C:\Users\Admin\AppData\Local\Temp\4f7f72d5fa0dbdd886de53c3e9bc01cd76bbb94d8d3b0d1deba3eb56d84f1ea4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
780.4MB

MD5
af1d98f91d02bc2eebbad39e65894697

SHA1
b780598056890ae004be1a30028fd09bad223b14

SHA256
f8e82f340b57f910ef96d915fed93e6220c9bb3842de1c3e110a06eb7d63af53

SHA512
87b653735773371230dc51bb6f97f52c8ef0f719fe2efd6374942b424b1bc3d9ccc903fd0d25b73e12fb9a3495ca4f0e822cb87c834ecb7221a43699ce1125a2

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
789.4MB

MD5
3d1a500ae490455547aac313d703ec71

SHA1
44ff23526750e6eb229d37a81232aa7d4f812de6

SHA256
7e3465e1ffb128d1f42acb80c4a20aa92b1812a6e62cf4f79fd0c0981c9078f6

SHA512
db0ca80a5f00ca1de48ae24bd893afdef5cc166ced2ac860f79754c7242c7753b153951a8802fc9412ae86663577d0291a8e9c6856c087db618962c47fef1108

Download Submit
memory/1220-141-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-144-0x00007FF953BF0000-0x00007FF953DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1220-137-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-138-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-139-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-140-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-155-0x00007FF953BF0000-0x00007FF953DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1220-142-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-143-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-136-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-146-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-147-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-148-0x00007FF953BF0000-0x00007FF953DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1220-135-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-151-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-134-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1220-133-0x0000000000BA0000-0x00000000015FB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-158-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-169-0x00007FF953BF0000-0x00007FF953DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1340-157-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-154-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-159-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-160-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-161-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-162-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-164-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-165-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-166-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-167-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-168-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-156-0x00007FF953BF0000-0x00007FF953DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1340-170-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-171-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-172-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-173-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-174-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-175-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-176-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-178-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-179-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-180-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-181-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-182-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download
memory/1340-183-0x0000000000950000-0x00000000013AB000-memory.dmp

Filesize
10.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads