Malware Analysis Report

2024-10-19 01:10

Sample ID 230729-ffqr4sah92
Target 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac
SHA256 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac
Tags
laplas clipper evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac

Threat Level: Known bad

The file 6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac was found to be: Known bad.

Malicious Activity Summary

laplas clipper evasion persistence stealer trojan

Laplas Clipper

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of WriteProcessMemory

GoLang User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-29 04:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-29 04:49

Reported

2023-07-29 04:54

Platform

win7-20230712-en

Max time kernel

277s

Max time network

291s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe

"C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
NL 185.209.161.89:80 185.209.161.89 tcp

Files

memory/2344-54-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-55-0x0000000077B90000-0x0000000077D39000-memory.dmp

memory/2344-56-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-57-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-58-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-59-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-60-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-61-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-62-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-63-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-64-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-65-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-66-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-67-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-68-0x0000000077B90000-0x0000000077D39000-memory.dmp

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 8187aa38e5cde76b882d2dc90031493c
SHA1 3cc83e2e5ec155bbd6ef5838383f5f439ef43a84
SHA256 e37ccd85260f72f1a91ade75eff3f69640376a88dae8ff740fc8613ec16c3f56
SHA512 c972ec786d32e3e67e3422f4ef886ebec51b39c35b16cbec85483acdbbb9f523f703c57d1f53b0d9664a5dcf7cb68e5d0d3cef790b714ed2a911533b7c29ccc1

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 8187aa38e5cde76b882d2dc90031493c
SHA1 3cc83e2e5ec155bbd6ef5838383f5f439ef43a84
SHA256 e37ccd85260f72f1a91ade75eff3f69640376a88dae8ff740fc8613ec16c3f56
SHA512 c972ec786d32e3e67e3422f4ef886ebec51b39c35b16cbec85483acdbbb9f523f703c57d1f53b0d9664a5dcf7cb68e5d0d3cef790b714ed2a911533b7c29ccc1

memory/2344-74-0x0000000028CD0000-0x00000000298FC000-memory.dmp

memory/2096-75-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2344-73-0x0000000001330000-0x0000000001F5C000-memory.dmp

memory/2344-76-0x0000000077B90000-0x0000000077D39000-memory.dmp

memory/2096-77-0x0000000077B90000-0x0000000077D39000-memory.dmp

memory/2096-78-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-79-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-80-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-81-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-82-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-83-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-84-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-85-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-86-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-87-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-88-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-89-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-90-0x0000000077B90000-0x0000000077D39000-memory.dmp

memory/2096-91-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-92-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-93-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-94-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-95-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-96-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-99-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-100-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-101-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-102-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-103-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-104-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-105-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-106-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-107-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-108-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-109-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-110-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-111-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-112-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-113-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-114-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-115-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-116-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-117-0x0000000000350000-0x0000000000F7C000-memory.dmp

memory/2096-118-0x0000000000350000-0x0000000000F7C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-29 04:49

Reported

2023-07-29 04:54

Platform

win10-20230703-en

Max time kernel

299s

Max time network

265s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4175128012-676912335-1083716439-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe

"C:\Users\Admin\AppData\Local\Temp\6c409b3b0df0aa505ee678977b9af11b28a4456ca73c6fa99be6b30d31849dac.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
NL 185.209.161.89:80 185.209.161.89 tcp
US 8.8.8.8:53 89.161.209.185.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

memory/4780-120-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-121-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-122-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-123-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-124-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-125-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-126-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-127-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-128-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-129-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-130-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-131-0x00007FFC9AA30000-0x00007FFC9AC0B000-memory.dmp

memory/4780-132-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-133-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-135-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4780-136-0x00007FFC9AA30000-0x00007FFC9AC0B000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 9ec970bd9de18a3e8444622f631d1a80
SHA1 89448e278e5c60203d4157e2d90caf483334053c
SHA256 05e1699f40528e22098baff570d6d8d4ee178ec67cde0b24076a7c7ab0e76710
SHA512 b3e817a5459754616693a68a707b39082fc6fc662ace50648deef2440aa5091b94b365677d1c2f5d4f095669975e4455a573d3819f27b024b55d4996fd00c221

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 9ec970bd9de18a3e8444622f631d1a80
SHA1 89448e278e5c60203d4157e2d90caf483334053c
SHA256 05e1699f40528e22098baff570d6d8d4ee178ec67cde0b24076a7c7ab0e76710
SHA512 b3e817a5459754616693a68a707b39082fc6fc662ace50648deef2440aa5091b94b365677d1c2f5d4f095669975e4455a573d3819f27b024b55d4996fd00c221

memory/4780-140-0x0000000000920000-0x000000000154C000-memory.dmp

memory/4452-142-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4780-143-0x00007FFC9AA30000-0x00007FFC9AC0B000-memory.dmp

memory/4452-144-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-145-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-146-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-147-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-148-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-149-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-150-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-152-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-153-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-154-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-155-0x00007FFC9AA30000-0x00007FFC9AC0B000-memory.dmp

memory/4452-156-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-157-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-158-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-159-0x00007FFC9AA30000-0x00007FFC9AC0B000-memory.dmp

memory/4452-160-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-161-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-163-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-164-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-165-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-166-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-167-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-168-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-169-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-170-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-171-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-172-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-173-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-174-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-175-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-176-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-177-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-178-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-179-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-180-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-181-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-182-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-183-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-184-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-185-0x0000000001240000-0x0000000001E6C000-memory.dmp

memory/4452-186-0x0000000001240000-0x0000000001E6C000-memory.dmp