Analysis
-
max time kernel
299s -
max time network
265s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
29-07-2023 04:49
General
-
Target
6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe
-
Size
6.2MB
-
MD5
c1bdc48d24699fd1d43938a3f32fa7fd
-
SHA1
08bdc9543146ea0f16d32237cca2c4446f9b3a80
-
SHA256
6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac
-
SHA512
80bf4c3c2f8face2432d0ebee8ae0982efc2e576dd5f0898fdff434927a6ad6079c793e5cd75835e4cfbd9f1ad831882c625e1df89893c69488a469f5e81eecf
-
SSDEEP
196608:OgvS7Syd4AnGKG3ZWQm1f6c2kjWNM69UWr:Pa7HFnGhkd1f6c2kjR6+Wr
Malware Config
Extracted
laplas
http://185.209.161.89
-
api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
730.2MB
MD59ec970bd9de18a3e8444622f631d1a80
SHA189448e278e5c60203d4157e2d90caf483334053c
SHA25605e1699f40528e22098baff570d6d8d4ee178ec67cde0b24076a7c7ab0e76710
SHA512b3e817a5459754616693a68a707b39082fc6fc662ace50648deef2440aa5091b94b365677d1c2f5d4f095669975e4455a573d3819f27b024b55d4996fd00c221
-
Filesize
730.2MB
MD59ec970bd9de18a3e8444622f631d1a80
SHA189448e278e5c60203d4157e2d90caf483334053c
SHA25605e1699f40528e22098baff570d6d8d4ee178ec67cde0b24076a7c7ab0e76710
SHA512b3e817a5459754616693a68a707b39082fc6fc662ace50648deef2440aa5091b94b365677d1c2f5d4f095669975e4455a573d3819f27b024b55d4996fd00c221
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
1.9MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
1.9MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB