Analysis
-
max time kernel
299s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
30-07-2023 23:19
General
-
Target
26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe
-
Size
3.4MB
-
MD5
9cc8c2df003851e7a8fd1ffb8386eb5f
-
SHA1
917bf018cd62ddf5dd4f4d1709451901204b90a2
-
SHA256
26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc
-
SHA512
6ea0e39be36c3fd70bdc7367c7a3e2e2f85426f30f7922d8dc53567bc8a068612db4f81714c356bf418240adb8fd845b3715029335bee9692167d60cf151576a
-
SSDEEP
49152:ZCfCy+NPnKB9iN5zR6goQk9O1x5gIhodeeLMTnGdJaoYB+rkB4JtIiMj3q9/Yy:qiKB9GZ+O1xPWeDGdJ/YB+sCM+9/Yy
Malware Config
Extracted
laplas
http://185.209.161.89
-
api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe"C:\Users\Admin\AppData\Local\Temp\26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
798.4MB
MD583928261525456d29f59dca1ed2d2d3e
SHA124380f35a6d9ad7ad10f30c88add55cb50e4745f
SHA25614a8205709b18a3d40c4526a84fd01786a8703000c92077450ceca3840f293ad
SHA512fd25adc24cc9c68c77fbbc26f4e427ab8002203cba30a0db7416c70e400a411fb1aa730c60c6988cc290d575d0624ce78b2856f3ea5e35db3380f11528b30a20
-
Filesize
798.4MB
MD583928261525456d29f59dca1ed2d2d3e
SHA124380f35a6d9ad7ad10f30c88add55cb50e4745f
SHA25614a8205709b18a3d40c4526a84fd01786a8703000c92077450ceca3840f293ad
SHA512fd25adc24cc9c68c77fbbc26f4e427ab8002203cba30a0db7416c70e400a411fb1aa730c60c6988cc290d575d0624ce78b2856f3ea5e35db3380f11528b30a20
-
Filesize
7.9MB
-
Filesize
1.7MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
1.7MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
1.7MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
1.7MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
1.7MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB