Analysis

  • max time kernel
    270s
  • max time network
    279s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22-07-2023 04:47

General

  • Target

    1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe

  • Size

    3.2MB

  • MD5

    17ac1c73bcfa7f1b0a516f519d7d7d7b

  • SHA1

    0d89c538b667a56753ecca6ad710cd8e04e47fba

  • SHA256

    1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b

  • SHA512

    12a89dede9fdb7ad7cd0bce7575ffa0de3002677f0b43ca61bdcb2fb328cac62fd2829691db3d6995ebdfcd477d98463e9e948ed96e68248aa956da848739aee

  • SSDEEP

    98304:7amyaFmPmjcy+m8TccYLZYje/IwjC294G:7hyacP+yXThYLOew8C29

Malware Config

Extracted

Family

laplas

C2

http://185.209.161.89

Attributes
  • api_key

    6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe
    "C:\Users\Admin\AppData\Local\Temp\1c53a85428c1768509983b471922058149f19579f524b1a31a8bba662171267b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    828.2MB

    MD5

    27bf98686a4c569849701bcc6e7a4b7b

    SHA1

    170b642a1470022c596cdacbfb1ea94627e0af34

    SHA256

    6712448f5a637c0e0925ecda3cf5a9b7fa9f5d5b0975dc6f0f4542badb326d20

    SHA512

    ddeb9f8898271dc023502c1409544e94096d62314a028ddf388ead66a143a3bc6ea5da62ee6825e47d08281ebf3f547fcaec6e5f333c4b1fd3dc80c269a60c49

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    828.2MB

    MD5

    27bf98686a4c569849701bcc6e7a4b7b

    SHA1

    170b642a1470022c596cdacbfb1ea94627e0af34

    SHA256

    6712448f5a637c0e0925ecda3cf5a9b7fa9f5d5b0975dc6f0f4542badb326d20

    SHA512

    ddeb9f8898271dc023502c1409544e94096d62314a028ddf388ead66a143a3bc6ea5da62ee6825e47d08281ebf3f547fcaec6e5f333c4b1fd3dc80c269a60c49

  • memory/1908-88-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-105-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-74-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-117-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-89-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/1908-116-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-115-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-114-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-113-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-112-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-111-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-110-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-109-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-108-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-107-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-106-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-76-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/1908-104-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-78-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-79-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-80-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-81-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-82-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-83-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-90-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-85-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-86-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-87-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-77-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-103-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-84-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-91-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-92-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-95-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-96-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-97-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-98-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-99-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-100-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-101-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/1908-102-0x0000000000F50000-0x0000000001711000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-75-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/2096-62-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-55-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/2096-67-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-73-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-63-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-65-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-59-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-60-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-61-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-69-0x0000000077A20000-0x0000000077BC9000-memory.dmp

    Filesize

    1.7MB

  • memory/2096-58-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-57-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-56-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-54-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-71-0x00000000285F0000-0x0000000028DB1000-memory.dmp

    Filesize

    7.8MB

  • memory/2096-64-0x00000000002A0000-0x0000000000A61000-memory.dmp

    Filesize

    7.8MB