Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    27-07-2023 11:52

General

  • Target

    taskhostclp.exe

  • Size

    3.8MB

  • MD5

    9b79f724b8ed77f9e3ce6a71b4cf909d

  • SHA1

    455751b77ffb738d260c6388f191aa590c40eb50

  • SHA256

    b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106

  • SHA512

    0feb6c94b6c8fbceb8e63b0629e33d72c6080003203080b7d376a0bdf3f1a3a170bd19e1ce81ba284ea15d96414f57031361ac3dbbadf3c13090d86798906fad

  • SSDEEP

    98304:egg3eNxij7+KwZL+iHkrzLSAu1SEJVARl0080jeG3KshnA:hguNxZB/RSE4W2ys5A

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\taskhostclp.exe
    "C:\Users\Admin\AppData\Local\Temp\taskhostclp.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    765.8MB

    MD5

    6b3381a04b3c25380a49308e56937abb

    SHA1

    22a054745c6fcd0a19890df72cd4e079e4553cf6

    SHA256

    1b6285d9f6f887a5b565280afed136c4d33cded05a18c5f906f61a1cc6c88d4e

    SHA512

    c6bd7be8676a8e2974e9fac9ded00e5c68bbef5cf43048f89058b7886436ca8199a1f4ad151561e1d395f01b7c627dae0c8dab43523c5508c4dcc626819d00c2

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    765.8MB

    MD5

    6b3381a04b3c25380a49308e56937abb

    SHA1

    22a054745c6fcd0a19890df72cd4e079e4553cf6

    SHA256

    1b6285d9f6f887a5b565280afed136c4d33cded05a18c5f906f61a1cc6c88d4e

    SHA512

    c6bd7be8676a8e2974e9fac9ded00e5c68bbef5cf43048f89058b7886436ca8199a1f4ad151561e1d395f01b7c627dae0c8dab43523c5508c4dcc626819d00c2

  • memory/1484-92-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-91-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-105-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-81-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-103-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-102-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-101-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-100-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-99-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-96-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-95-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-94-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-93-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-86-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-90-0x0000000076EA0000-0x0000000077049000-memory.dmp

    Filesize

    1.7MB

  • memory/1484-89-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-80-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-75-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-88-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-77-0x0000000076EA0000-0x0000000077049000-memory.dmp

    Filesize

    1.7MB

  • memory/1484-78-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-79-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-82-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-104-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-87-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-83-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-84-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1484-85-0x0000000001380000-0x0000000001BEC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-56-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-73-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-76-0x0000000076EA0000-0x0000000077049000-memory.dmp

    Filesize

    1.7MB

  • memory/1664-74-0x0000000028670000-0x0000000028EDC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-55-0x0000000076EA0000-0x0000000077049000-memory.dmp

    Filesize

    1.7MB

  • memory/1664-70-0x0000000076EA0000-0x0000000077049000-memory.dmp

    Filesize

    1.7MB

  • memory/1664-54-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-57-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-67-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-66-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-65-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-64-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-63-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-62-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-61-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-60-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-59-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB

  • memory/1664-58-0x0000000000880000-0x00000000010EC000-memory.dmp

    Filesize

    8.4MB