Analysis

  • max time kernel
    292s
  • max time network
    191s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-07-2023 04:51

General

  • Target

    b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe

  • Size

    3.8MB

  • MD5

    9b79f724b8ed77f9e3ce6a71b4cf909d

  • SHA1

    455751b77ffb738d260c6388f191aa590c40eb50

  • SHA256

    b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106

  • SHA512

    0feb6c94b6c8fbceb8e63b0629e33d72c6080003203080b7d376a0bdf3f1a3a170bd19e1ce81ba284ea15d96414f57031361ac3dbbadf3c13090d86798906fad

  • SSDEEP

    98304:egg3eNxij7+KwZL+iHkrzLSAu1SEJVARl0080jeG3KshnA:hguNxZB/RSE4W2ys5A

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe
    "C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    786.8MB

    MD5

    35bf0e7b42418df94fbc6cf03d3b05c7

    SHA1

    9cb50d200082064cf71e2aa15eaa84b01f49654b

    SHA256

    64a363d3ec7c6e958182c7372b4f8ab53d0e098c13aafda58cf00b862c527173

    SHA512

    f96bf3d042f8885969ca4ae4cc6818a1e40d6db04b3307e2d46e1a3dd44345f3d66ebe01d4568dbbd70ed5b1eb2a91bf92e6562a9080ad24322c5ae7aa7d2303

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    786.8MB

    MD5

    35bf0e7b42418df94fbc6cf03d3b05c7

    SHA1

    9cb50d200082064cf71e2aa15eaa84b01f49654b

    SHA256

    64a363d3ec7c6e958182c7372b4f8ab53d0e098c13aafda58cf00b862c527173

    SHA512

    f96bf3d042f8885969ca4ae4cc6818a1e40d6db04b3307e2d46e1a3dd44345f3d66ebe01d4568dbbd70ed5b1eb2a91bf92e6562a9080ad24322c5ae7aa7d2303

  • memory/1076-170-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-171-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-186-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-185-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-155-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-154-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-183-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-182-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-181-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-180-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-179-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-178-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-177-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-176-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-175-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-174-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-142-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-173-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-144-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

    Filesize

    1.9MB

  • memory/1076-145-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-146-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-147-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-148-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-149-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-150-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-151-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-152-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-153-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-184-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-172-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-156-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-157-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-158-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-159-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

    Filesize

    1.9MB

  • memory/1076-160-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-161-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-163-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-164-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-165-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-166-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-167-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-168-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1076-169-0x00000000008E0000-0x000000000114C000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-125-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-123-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

    Filesize

    1.9MB

  • memory/1144-122-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-143-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

    Filesize

    1.9MB

  • memory/1144-128-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-140-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-124-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-133-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-134-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-136-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-126-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-132-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-131-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-130-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-129-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-127-0x0000000000C50000-0x00000000014BC000-memory.dmp

    Filesize

    8.4MB

  • memory/1144-137-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

    Filesize

    1.9MB