Analysis

  • max time kernel
    275s
  • max time network
    293s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2023 03:40

General

  • Target

    e522454c7fb915cb65e42e67ea9890df5ead1356053e563c43a1603f669c6fa2.exe

  • Size

    3.9MB

  • MD5

    2aa0fe002aeee888c33dbb6864580e6c

  • SHA1

    e10a14cede8f2e48ccd6fb5111583fcf5156030a

  • SHA256

    e522454c7fb915cb65e42e67ea9890df5ead1356053e563c43a1603f669c6fa2

  • SHA512

    0598092827b729fa9720f4fbd61087323fce6fb7318fb286784fcc125c5e64d69a0d9cdb57ee11ca0f7474dffd17b7af647ef71affafdb0fc608b705bd66d1fd

  • SSDEEP

    98304:LdD7hTCd16KI1cqLrUmolDD/0z+lzZQ57j:LJ7F4wcYUdRzI7j

Malware Config

Extracted

Family

laplas

C2

http://185.209.161.89

Attributes
  • api_key

    6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e522454c7fb915cb65e42e67ea9890df5ead1356053e563c43a1603f669c6fa2.exe
    "C:\Users\Admin\AppData\Local\Temp\e522454c7fb915cb65e42e67ea9890df5ead1356053e563c43a1603f669c6fa2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    830.9MB

    MD5

    f5b7f31d3b64fdcc36f8efcc61bd7a28

    SHA1

    f23e4081f757c3acea0a260ef18af2c69c9d7c6a

    SHA256

    7cc06cd0942a0428dfe56d0ed08f0d6327124fc3ff85b520d529e38cccaadb48

    SHA512

    cdccacadd9bf59279f49070f99122aaadaba9b80b79954335ddfaeb26630640610f0b53176c537325e0881a9ae9a96d17910b0bccd547d4369e83329e380b21e

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    830.9MB

    MD5

    f5b7f31d3b64fdcc36f8efcc61bd7a28

    SHA1

    f23e4081f757c3acea0a260ef18af2c69c9d7c6a

    SHA256

    7cc06cd0942a0428dfe56d0ed08f0d6327124fc3ff85b520d529e38cccaadb48

    SHA512

    cdccacadd9bf59279f49070f99122aaadaba9b80b79954335ddfaeb26630640610f0b53176c537325e0881a9ae9a96d17910b0bccd547d4369e83329e380b21e

  • memory/2016-103-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-104-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-119-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-118-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-87-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-86-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-116-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-115-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-114-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-113-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-112-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-111-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-110-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-109-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-108-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-107-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-106-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-77-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-105-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-102-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-78-0x0000000076D40000-0x0000000076EE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2016-79-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-80-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-81-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-82-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-83-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-84-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-85-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-117-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-101-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-88-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-89-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-90-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-91-0x0000000076D40000-0x0000000076EE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2016-92-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-93-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-94-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-95-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-96-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-97-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2016-100-0x00000000003E0000-0x0000000000D09000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-61-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-74-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-60-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-57-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-73-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-76-0x0000000076D40000-0x0000000076EE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2548-68-0x0000000076D40000-0x0000000076EE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2548-58-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-54-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-55-0x0000000076D40000-0x0000000076EE9000-memory.dmp

    Filesize

    1.7MB

  • memory/2548-66-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-67-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-65-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-64-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-63-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-62-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-56-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-59-0x0000000000C00000-0x0000000001529000-memory.dmp

    Filesize

    9.2MB

  • memory/2548-75-0x0000000028990000-0x00000000292B9000-memory.dmp

    Filesize

    9.2MB