Analysis

  • max time kernel
    275s
  • max time network
    289s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2023 04:47

General

  • Target

    11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c.exe

  • Size

    4.0MB

  • MD5

    3258deefff3ca70f3dfa3e67067ca611

  • SHA1

    a28ec103c22b03f381dd72073cf620b11881b7b7

  • SHA256

    11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

  • SHA512

    541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

  • SSDEEP

    98304:kIk6g0kDf8CFjiD+THrrTfmqWAfheTYC521KuM96+/xnVA:3K0skC1k+THrrTf/c5ekwgVA

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c.exe
    "C:\Users\Admin\AppData\Local\Temp\11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    809.0MB

    MD5

    48c88a8432685ddbbaea57d562a18754

    SHA1

    95557abeb74f5e5028dcdebaefa8f36ba246d76f

    SHA256

    7f25322dc69139c2d255bc9ead919f5e614e066e9654d8913692a347688d14f3

    SHA512

    9d187125e17b075aef8545cde5e7ab11857dab0673b95536d923dc575d578c030dd96696693c02f8988d4e36930581d79a0cc3c610885dd742c44f4acda5d2dd

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    809.0MB

    MD5

    48c88a8432685ddbbaea57d562a18754

    SHA1

    95557abeb74f5e5028dcdebaefa8f36ba246d76f

    SHA256

    7f25322dc69139c2d255bc9ead919f5e614e066e9654d8913692a347688d14f3

    SHA512

    9d187125e17b075aef8545cde5e7ab11857dab0673b95536d923dc575d578c030dd96696693c02f8988d4e36930581d79a0cc3c610885dd742c44f4acda5d2dd

  • memory/584-104-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-105-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-119-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-118-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-117-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-116-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-88-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-115-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-114-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-113-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-112-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-111-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-110-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-109-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-108-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-107-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-106-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-76-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-103-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-78-0x0000000077860000-0x0000000077A09000-memory.dmp

    Filesize

    1.7MB

  • memory/584-79-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-80-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-81-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-82-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-83-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-89-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-87-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-86-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-85-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-102-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-84-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-90-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-91-0x0000000077860000-0x0000000077A09000-memory.dmp

    Filesize

    1.7MB

  • memory/584-92-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-93-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-94-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-97-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-98-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-99-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-100-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/584-101-0x00000000010F0000-0x0000000001A33000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-58-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-54-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-66-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-67-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-55-0x0000000077860000-0x0000000077A09000-memory.dmp

    Filesize

    1.7MB

  • memory/2476-75-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-72-0x0000000028700000-0x0000000029043000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-77-0x0000000077860000-0x0000000077A09000-memory.dmp

    Filesize

    1.7MB

  • memory/2476-68-0x0000000077860000-0x0000000077A09000-memory.dmp

    Filesize

    1.7MB

  • memory/2476-57-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-56-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-65-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-64-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-63-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-60-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-61-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-62-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB

  • memory/2476-59-0x0000000000E80000-0x00000000017C3000-memory.dmp

    Filesize

    9.3MB