Analysis

  • max time kernel
    134s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2023 08:11

General

  • Target

    f4695fd70f1ed48d7e31f7ba81380059.exe

  • Size

    4.9MB

  • MD5

    f4695fd70f1ed48d7e31f7ba81380059

  • SHA1

    960a03052f1b240e9f44ea416ff7e65358d8a41a

  • SHA256

    626a5e1642d856a65b62dc2dff5b1369fa3bd66b000278db83d2d5d67e8289ed

  • SHA512

    04a5b544869cc408b66e0f2e9e669b6bc5f366bf9acd2f3d792176e8506f8808dd0cef27d7d3b8c52542566529e0dcec2d1fa0467e96f46a9013a663dff2fc59

  • SSDEEP

    98304:zomYgKWWA1fGjzpSmL7CfDbHsATgXCagCpSP/0aJ67k0w6wdTM:ELgKWfQzDLWTcClCpwyk0w9M

Malware Config

Extracted

Family

laplas

C2

http://168.100.10.236

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4695fd70f1ed48d7e31f7ba81380059.exe
    "C:\Users\Admin\AppData\Local\Temp\f4695fd70f1ed48d7e31f7ba81380059.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2264

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    743.9MB

    MD5

    2faa01fc52878bb114c02b6a4a0f3c61

    SHA1

    6773a6aec12b637a5bef685ba6e2a4aa1fce03ed

    SHA256

    98472d39d475029a07d624b3f30d4910d8ece295380ce6a3150186c57fa3fb19

    SHA512

    ace541b522e86af316087fb3fe02fea3079ba48643ae485631c0f579303d5135e9d52d93b853f263b6130dda47f7c3daf9ad1947858c22bf7b42933297273d6c

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    743.9MB

    MD5

    2faa01fc52878bb114c02b6a4a0f3c61

    SHA1

    6773a6aec12b637a5bef685ba6e2a4aa1fce03ed

    SHA256

    98472d39d475029a07d624b3f30d4910d8ece295380ce6a3150186c57fa3fb19

    SHA512

    ace541b522e86af316087fb3fe02fea3079ba48643ae485631c0f579303d5135e9d52d93b853f263b6130dda47f7c3daf9ad1947858c22bf7b42933297273d6c

  • memory/1712-59-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-64-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-58-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-73-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-60-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-61-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-62-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-63-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-65-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-57-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-66-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-67-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-68-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/1712-56-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-55-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/1712-74-0x0000000028B00000-0x00000000294EB000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-54-0x0000000001270000-0x0000000001C5B000-memory.dmp

    Filesize

    9.9MB

  • memory/1712-75-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/2264-78-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-89-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-76-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-79-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-80-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-81-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-82-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-83-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-84-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-85-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-86-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-87-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-88-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-77-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/2264-90-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/2264-91-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-92-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-93-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-94-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-95-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-96-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-99-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-100-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-101-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-102-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-103-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-104-0x00000000000D0000-0x0000000000ABB000-memory.dmp

    Filesize

    9.9MB