Analysis

  • max time kernel
    270s
  • max time network
    281s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22-07-2023 22:13

General

  • Target

    6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f.exe

  • Size

    4.4MB

  • MD5

    24c40e66db640789a022cb839b28d476

  • SHA1

    b6000f4b0e71ce952267e7e5728bc4181877c497

  • SHA256

    6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f

  • SHA512

    481240b66ac8eb61b8a9aa6e22e14abdffba7869695c7b92214029a714b619319d3c50bc640e79bf790de309d5a412f4e0fecabc1082acd52d1984c8c8f8f0cd

  • SSDEEP

    98304:/C0+qzz+DpM8iptpFvoyDz8nFEPlSV20WKeaGLjc1TLAOjs5O:K0X2dM8iPpF/Dz8nFSl90WWGLjc1HAOd

Malware Config

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f.exe
    "C:\Users\Admin\AppData\Local\Temp\6bbcf743fa00cfa33aa60a923d319850111d610b44cfdbe1b5dc6c672f177a8f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    791.4MB

    MD5

    ce498ed5533a00e29b88e8111186dbd7

    SHA1

    fd39271a61c786fdf47feb4f80935554835b44e7

    SHA256

    d761cc365e5cde907122d738e607b226795740c4d7f1b01194894ff67c68e967

    SHA512

    a4499605605235a63a77e1b1cc3101840fe771f6d55c4402a98d3d078dd151ecdb45c44cb4650906d4dd4fa8df39c2dd0eb20bf82a7e60ab4b0266c14def7f5b

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    791.4MB

    MD5

    ce498ed5533a00e29b88e8111186dbd7

    SHA1

    fd39271a61c786fdf47feb4f80935554835b44e7

    SHA256

    d761cc365e5cde907122d738e607b226795740c4d7f1b01194894ff67c68e967

    SHA512

    a4499605605235a63a77e1b1cc3101840fe771f6d55c4402a98d3d078dd151ecdb45c44cb4650906d4dd4fa8df39c2dd0eb20bf82a7e60ab4b0266c14def7f5b

  • memory/1248-100-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-103-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-116-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-115-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-114-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-113-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-87-0x00000000777B0000-0x0000000077959000-memory.dmp

    Filesize

    1.7MB

  • memory/1248-112-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-111-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-110-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-109-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-108-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-107-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-106-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-105-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-104-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-73-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-75-0x00000000777B0000-0x0000000077959000-memory.dmp

    Filesize

    1.7MB

  • memory/1248-76-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-88-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-78-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-79-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-80-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-81-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-82-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-83-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-84-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-85-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-86-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-102-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-77-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-89-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-90-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-91-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-92-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-93-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-94-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-97-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-98-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-99-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1248-101-0x0000000000810000-0x0000000001102000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-74-0x00000000777B0000-0x0000000077959000-memory.dmp

    Filesize

    1.7MB

  • memory/1508-65-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-57-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-56-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-54-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-72-0x00000000284E0000-0x0000000028DD2000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-70-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-62-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-71-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-55-0x00000000777B0000-0x0000000077959000-memory.dmp

    Filesize

    1.7MB

  • memory/1508-64-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-63-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-61-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-60-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-59-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB

  • memory/1508-58-0x0000000000E50000-0x0000000001742000-memory.dmp

    Filesize

    8.9MB