Analysis

  • max time kernel
    287s
  • max time network
    277s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22-07-2023 22:11

General

  • Target

    1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe

  • Size

    3.2MB

  • MD5

    17ac1c73bcfa7f1b0a516f519d7d7d7b

  • SHA1

    0d89c538b667a56753ecca6ad710cd8e04e47fba

  • SHA256

    1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b

  • SHA512

    12a89dede9fdb7ad7cd0bce7575ffa0de3002677f0b43ca61bdcb2fb328cac62fd2829691db3d6995ebdfcd477d98463e9e948ed96e68248aa956da848739aee

  • SSDEEP

    98304:7amyaFmPmjcy+m8TccYLZYje/IwjC294G:7hyacP+yXThYLOew8C29

Malware Config

Extracted

Family

laplas

C2

http://185.209.161.89

Attributes
  • api_key

    6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe
    "C:\Users\Admin\AppData\Local\Temp\1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    771.2MB

    MD5

    a935184afcd9efa06ed76c4691916406

    SHA1

    691e5ccbf1ae8f0cb6d48e1e50eeea746276bbac

    SHA256

    8eb707caccdb600ecd6378c937f89e9a8c40de24bbdacf47cc3d610c14f727b0

    SHA512

    41feca7770eaf60150e130bf8c3119e1e0352786e92c07af523b8eaeb64e0069167d4207d1c8951636ad1970d4e090b2d431a3e47b07cf7faf2fac81ee992bf4

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    771.2MB

    MD5

    a935184afcd9efa06ed76c4691916406

    SHA1

    691e5ccbf1ae8f0cb6d48e1e50eeea746276bbac

    SHA256

    8eb707caccdb600ecd6378c937f89e9a8c40de24bbdacf47cc3d610c14f727b0

    SHA512

    41feca7770eaf60150e130bf8c3119e1e0352786e92c07af523b8eaeb64e0069167d4207d1c8951636ad1970d4e090b2d431a3e47b07cf7faf2fac81ee992bf4

  • memory/1616-64-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-65-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-58-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-59-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-60-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-61-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-62-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-63-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-77-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/1616-57-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-66-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-67-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-68-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/1616-69-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-56-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-55-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/1616-74-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-75-0x0000000028430000-0x0000000028BF1000-memory.dmp

    Filesize

    7.8MB

  • memory/1616-54-0x0000000000270000-0x0000000000A31000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-86-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-100-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-79-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-80-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-81-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-82-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-83-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-84-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-85-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-76-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-87-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-88-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-89-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-90-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-91-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/1688-92-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-93-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-94-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-95-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-96-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-97-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-78-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/1688-101-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-102-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-103-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-104-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-105-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-106-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-107-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-108-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-109-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-110-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-111-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-112-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-113-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-114-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-115-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-116-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-117-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-118-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-119-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB

  • memory/1688-120-0x00000000000D0000-0x0000000000891000-memory.dmp

    Filesize

    7.8MB