Analysis

  • max time kernel
    298s
  • max time network
    266s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22-07-2023 22:11

General

  • Target

    1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe

  • Size

    3.2MB

  • MD5

    17ac1c73bcfa7f1b0a516f519d7d7d7b

  • SHA1

    0d89c538b667a56753ecca6ad710cd8e04e47fba

  • SHA256

    1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b

  • SHA512

    12a89dede9fdb7ad7cd0bce7575ffa0de3002677f0b43ca61bdcb2fb328cac62fd2829691db3d6995ebdfcd477d98463e9e948ed96e68248aa956da848739aee

  • SSDEEP

    98304:7amyaFmPmjcy+m8TccYLZYje/IwjC294G:7hyacP+yXThYLOew8C29

Malware Config

Extracted

Family

laplas

C2

http://185.209.161.89

Attributes
  • api_key

    6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe
    "C:\Users\Admin\AppData\Local\Temp\1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    840.2MB

    MD5

    48fa4701dfcb885a2c0bd9b500dd477a

    SHA1

    63fa116ae3843ad513468112472d85891073977f

    SHA256

    351af24626cc5eb4b9e8e56213618996cc695d552d95bbb6c14bd23b4056e0c3

    SHA512

    81d725ffb2e1045b10f9ea02be5aa62260fb18b0e2735c458497a87f353ac4e32f66dff23d76b015c75eb08d31d5d904d326cbfa378f2b45ac524f6eeeb47506

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    840.2MB

    MD5

    48fa4701dfcb885a2c0bd9b500dd477a

    SHA1

    63fa116ae3843ad513468112472d85891073977f

    SHA256

    351af24626cc5eb4b9e8e56213618996cc695d552d95bbb6c14bd23b4056e0c3

    SHA512

    81d725ffb2e1045b10f9ea02be5aa62260fb18b0e2735c458497a87f353ac4e32f66dff23d76b015c75eb08d31d5d904d326cbfa378f2b45ac524f6eeeb47506

  • memory/4428-125-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-126-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-121-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-122-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-123-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-124-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-138-0x00007FF85A520000-0x00007FF85A6FB000-memory.dmp

    Filesize

    1.9MB

  • memory/4428-120-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-127-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-128-0x00007FF85A520000-0x00007FF85A6FB000-memory.dmp

    Filesize

    1.9MB

  • memory/4428-130-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-132-0x00007FF85A520000-0x00007FF85A6FB000-memory.dmp

    Filesize

    1.9MB

  • memory/4428-135-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-119-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-117-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4428-118-0x0000000000070000-0x0000000000831000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-150-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-160-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-140-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-141-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-142-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-143-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-144-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-145-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-146-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-147-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-148-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-149-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-137-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-151-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-152-0x00007FF85A520000-0x00007FF85A6FB000-memory.dmp

    Filesize

    1.9MB

  • memory/4632-153-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-154-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-155-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-156-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-157-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-158-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-139-0x00007FF85A520000-0x00007FF85A6FB000-memory.dmp

    Filesize

    1.9MB

  • memory/4632-161-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-162-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-163-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-164-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-165-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-166-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-167-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-168-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-169-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-170-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-171-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-172-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-173-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-174-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-175-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-176-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-177-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-178-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-179-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-180-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-181-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB

  • memory/4632-182-0x0000000000C30000-0x00000000013F1000-memory.dmp

    Filesize

    7.8MB