Malware Analysis Report

2024-10-23 15:42

Sample ID 230727-fgzreaad4t
Target b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106
SHA256 b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106
Tags
laplas clipper evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106

Threat Level: Known bad

The file b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106 was found to be: Known bad.

Malicious Activity Summary

laplas clipper evasion persistence stealer trojan

Laplas Clipper

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Loads dropped DLL

Checks BIOS information in registry

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of WriteProcessMemory

GoLang User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-27 04:51

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-27 04:51

Reported

2023-07-27 04:56

Platform

win7-20230712-en

Max time kernel

275s

Max time network

287s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe

"C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
US 206.189.229.43:80 206.189.229.43 tcp

Files

memory/2060-54-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-55-0x0000000077C70000-0x0000000077E19000-memory.dmp

memory/2060-56-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-57-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-58-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-59-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-60-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-61-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-62-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-64-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-65-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-63-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-66-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-67-0x00000000001B0000-0x0000000000A1C000-memory.dmp

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 398d206bc0c1dc43fdf6c0e79dad25fa
SHA1 58a980228838af5aa989ed22f0e594003658a6e6
SHA256 cbf34cea157d2776878d4c23edfa43d1edc33d150b5de4ba93cd7bb2bd38353c
SHA512 0937f5a237f67e7f0d3de7f07891d5d0b4dc54a5fad696ab24677d6a0493b324b935af719ae821e5bf6bae307ec9b525d03af9a902a61e72cd2798aeaa2bd1cf

memory/2060-70-0x0000000077C70000-0x0000000077E19000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 398d206bc0c1dc43fdf6c0e79dad25fa
SHA1 58a980228838af5aa989ed22f0e594003658a6e6
SHA256 cbf34cea157d2776878d4c23edfa43d1edc33d150b5de4ba93cd7bb2bd38353c
SHA512 0937f5a237f67e7f0d3de7f07891d5d0b4dc54a5fad696ab24677d6a0493b324b935af719ae821e5bf6bae307ec9b525d03af9a902a61e72cd2798aeaa2bd1cf

memory/2060-73-0x00000000001B0000-0x0000000000A1C000-memory.dmp

memory/2060-74-0x0000000028810000-0x000000002907C000-memory.dmp

memory/2840-75-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2060-76-0x0000000077C70000-0x0000000077E19000-memory.dmp

memory/2840-77-0x0000000077C70000-0x0000000077E19000-memory.dmp

memory/2840-78-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-79-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-80-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-81-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-82-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-83-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-84-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-85-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-86-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-87-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-88-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-89-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-90-0x0000000077C70000-0x0000000077E19000-memory.dmp

memory/2840-91-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-92-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-93-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-94-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-95-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-96-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-99-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-100-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-101-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-102-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-103-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-104-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-105-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-106-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-107-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-108-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-109-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-110-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-111-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-112-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-113-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-114-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-115-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-116-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-117-0x0000000000950000-0x00000000011BC000-memory.dmp

memory/2840-118-0x0000000000950000-0x00000000011BC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-27 04:51

Reported

2023-07-27 04:56

Platform

win10-20230703-en

Max time kernel

292s

Max time network

191s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe

"C:\Users\Admin\AppData\Local\Temp\b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
US 206.189.229.43:80 206.189.229.43 tcp
US 8.8.8.8:53 43.229.189.206.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp

Files

memory/1144-122-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-123-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

memory/1144-124-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-125-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-126-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-127-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-128-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-129-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-130-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-131-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-132-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-133-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-134-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-136-0x0000000000C50000-0x00000000014BC000-memory.dmp

memory/1144-137-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 35bf0e7b42418df94fbc6cf03d3b05c7
SHA1 9cb50d200082064cf71e2aa15eaa84b01f49654b
SHA256 64a363d3ec7c6e958182c7372b4f8ab53d0e098c13aafda58cf00b862c527173
SHA512 f96bf3d042f8885969ca4ae4cc6818a1e40d6db04b3307e2d46e1a3dd44345f3d66ebe01d4568dbbd70ed5b1eb2a91bf92e6562a9080ad24322c5ae7aa7d2303

memory/1144-140-0x0000000000C50000-0x00000000014BC000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 35bf0e7b42418df94fbc6cf03d3b05c7
SHA1 9cb50d200082064cf71e2aa15eaa84b01f49654b
SHA256 64a363d3ec7c6e958182c7372b4f8ab53d0e098c13aafda58cf00b862c527173
SHA512 f96bf3d042f8885969ca4ae4cc6818a1e40d6db04b3307e2d46e1a3dd44345f3d66ebe01d4568dbbd70ed5b1eb2a91bf92e6562a9080ad24322c5ae7aa7d2303

memory/1076-142-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1144-143-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

memory/1076-144-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

memory/1076-145-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-146-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-147-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-148-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-149-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-150-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-151-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-152-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-153-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-154-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-155-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-156-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-157-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-158-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-159-0x00007FFAB3C40000-0x00007FFAB3E1B000-memory.dmp

memory/1076-160-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-161-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-163-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-164-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-165-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-166-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-167-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-168-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-169-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-170-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-171-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-172-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-173-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-174-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-175-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-176-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-177-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-178-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-179-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-180-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-181-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-182-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-183-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-184-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-185-0x00000000008E0000-0x000000000114C000-memory.dmp

memory/1076-186-0x00000000008E0000-0x000000000114C000-memory.dmp