Analysis

  • max time kernel
    275s
  • max time network
    287s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    27-07-2023 04:51

General

  • Target

    b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe

  • Size

    3.8MB

  • MD5

    9b79f724b8ed77f9e3ce6a71b4cf909d

  • SHA1

    455751b77ffb738d260c6388f191aa590c40eb50

  • SHA256

    b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106

  • SHA512

    0feb6c94b6c8fbceb8e63b0629e33d72c6080003203080b7d376a0bdf3f1a3a170bd19e1ce81ba284ea15d96414f57031361ac3dbbadf3c13090d86798906fad

  • SSDEEP

    98304:egg3eNxij7+KwZL+iHkrzLSAu1SEJVARl0080jeG3KshnA:hguNxZB/RSE4W2ys5A

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe
    "C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    839.8MB

    MD5

    398d206bc0c1dc43fdf6c0e79dad25fa

    SHA1

    58a980228838af5aa989ed22f0e594003658a6e6

    SHA256

    cbf34cea157d2776878d4c23edfa43d1edc33d150b5de4ba93cd7bb2bd38353c

    SHA512

    0937f5a237f67e7f0d3de7f07891d5d0b4dc54a5fad696ab24677d6a0493b324b935af719ae821e5bf6bae307ec9b525d03af9a902a61e72cd2798aeaa2bd1cf

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    839.8MB

    MD5

    398d206bc0c1dc43fdf6c0e79dad25fa

    SHA1

    58a980228838af5aa989ed22f0e594003658a6e6

    SHA256

    cbf34cea157d2776878d4c23edfa43d1edc33d150b5de4ba93cd7bb2bd38353c

    SHA512

    0937f5a237f67e7f0d3de7f07891d5d0b4dc54a5fad696ab24677d6a0493b324b935af719ae821e5bf6bae307ec9b525d03af9a902a61e72cd2798aeaa2bd1cf

  • memory/2060-65-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-63-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-58-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-59-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-60-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-61-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-62-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-64-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-76-0x0000000077C70000-0x0000000077E19000-memory.dmp

    Filesize

    1.7MB

  • memory/2060-57-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-66-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-67-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-56-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-70-0x0000000077C70000-0x0000000077E19000-memory.dmp

    Filesize

    1.7MB

  • memory/2060-55-0x0000000077C70000-0x0000000077E19000-memory.dmp

    Filesize

    1.7MB

  • memory/2060-73-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-74-0x0000000028810000-0x000000002907C000-memory.dmp

    Filesize

    8.4MB

  • memory/2060-54-0x00000000001B0000-0x0000000000A1C000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-86-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-99-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-78-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-79-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-80-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-81-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-82-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-83-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-84-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-85-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-75-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-87-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-88-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-89-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-90-0x0000000077C70000-0x0000000077E19000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-91-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-92-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-93-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-94-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-95-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-96-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-77-0x0000000077C70000-0x0000000077E19000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-100-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-101-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-102-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-103-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-104-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-105-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-106-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-107-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-108-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-109-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-110-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-111-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-112-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-113-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-114-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-115-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-116-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-117-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB

  • memory/2840-118-0x0000000000950000-0x00000000011BC000-memory.dmp

    Filesize

    8.4MB