Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2023 11:52

General

  • Target

    taskhostclp.exe

  • Size

    3.8MB

  • MD5

    9b79f724b8ed77f9e3ce6a71b4cf909d

  • SHA1

    455751b77ffb738d260c6388f191aa590c40eb50

  • SHA256

    b95ae0c815dc8fc44d8c8bbde1e853b96c3e1389fb30bcdf1d68f8e6a74b3106

  • SHA512

    0feb6c94b6c8fbceb8e63b0629e33d72c6080003203080b7d376a0bdf3f1a3a170bd19e1ce81ba284ea15d96414f57031361ac3dbbadf3c13090d86798906fad

  • SSDEEP

    98304:egg3eNxij7+KwZL+iHkrzLSAu1SEJVARl0080jeG3KshnA:hguNxZB/RSE4W2ys5A

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\taskhostclp.exe
    "C:\Users\Admin\AppData\Local\Temp\taskhostclp.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    664.1MB

    MD5

    919c4128783597bfae6c7b7448c27ae8

    SHA1

    acfa530fcbfde74cf903e86611873b19b341f7df

    SHA256

    c2cd8d77948ed6df3f22c2350ba153d79866ae3a91e6d2c11eb24c38b737a429

    SHA512

    4e078bc08670fa1088039f07b3b61d160f2b756bbd24fb833926163fc348dbf59951b936bb385fa3ca36fe2c8f5d62d1466002d97d872a3d8472155837178ad6

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    648.1MB

    MD5

    9bd3df033c806d3465a0b9509e09f1f1

    SHA1

    c34fae7f61afa42ec6381db2d1e1800449f00006

    SHA256

    44c41dcc6ee3c3993ce8e84607a844b5e8d012474ad67df4c9ed3ed5b59d164e

    SHA512

    e4a0c2fb96bb6ef1793cdb49050a7f0b3b648e38411fd27309a1ed0358346126237cd8ad6a078bf98e07d8ca5410f3d2f15df197cc875cdab2c0248c39da7031

  • memory/968-169-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-172-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-183-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-159-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-160-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-181-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-180-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-179-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-178-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-177-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-176-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-175-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-173-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-171-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-170-0x00007FF819190000-0x00007FF819385000-memory.dmp

    Filesize

    2.0MB

  • memory/968-168-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-167-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-161-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-166-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-156-0x00007FF819190000-0x00007FF819385000-memory.dmp

    Filesize

    2.0MB

  • memory/968-157-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-158-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-165-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-182-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-154-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-162-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/968-163-0x0000000000920000-0x000000000118C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-137-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-152-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-145-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-146-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-133-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-135-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-149-0x00007FF819190000-0x00007FF819385000-memory.dmp

    Filesize

    2.0MB

  • memory/3568-155-0x00007FF819190000-0x00007FF819385000-memory.dmp

    Filesize

    2.0MB

  • memory/3568-148-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-136-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-134-0x00007FF819190000-0x00007FF819385000-memory.dmp

    Filesize

    2.0MB

  • memory/3568-144-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-143-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-142-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-141-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-140-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-139-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB

  • memory/3568-138-0x00000000006A0000-0x0000000000F0C000-memory.dmp

    Filesize

    8.4MB