Analysis
-
max time kernel
291s -
max time network
248s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
30-07-2023 23:19
General
-
Target
26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe
-
Size
3.4MB
-
MD5
9cc8c2df003851e7a8fd1ffb8386eb5f
-
SHA1
917bf018cd62ddf5dd4f4d1709451901204b90a2
-
SHA256
26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc
-
SHA512
6ea0e39be36c3fd70bdc7367c7a3e2e2f85426f30f7922d8dc53567bc8a068612db4f81714c356bf418240adb8fd845b3715029335bee9692167d60cf151576a
-
SSDEEP
49152:ZCfCy+NPnKB9iN5zR6goQk9O1x5gIhodeeLMTnGdJaoYB+rkB4JtIiMj3q9/Yy:qiKB9GZ+O1xPWeDGdJ/YB+sCM+9/Yy
Malware Config
Extracted
laplas
http://185.209.161.89
-
api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe"C:\Users\Admin\AppData\Local\Temp\26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
785.4MB
MD5af330f0b7212163246bec30474a8a35a
SHA15209d326bf5ba18b7606296f27697fc3b78bc4cc
SHA256d8bf3d35bc23529b1605dc8bcaedbae47e4b3f3c8ef8fb41ca1fbf867846bb5b
SHA51290d2f1a358624b80ef88af0264bd99ccb99d1e015c83296359320b973f0f52475cf81aa340f5b9fcb469aeacbf8e6dc0860c6c24d86823e9b71dc4facaabaf4a
-
Filesize
785.4MB
MD5af330f0b7212163246bec30474a8a35a
SHA15209d326bf5ba18b7606296f27697fc3b78bc4cc
SHA256d8bf3d35bc23529b1605dc8bcaedbae47e4b3f3c8ef8fb41ca1fbf867846bb5b
SHA51290d2f1a358624b80ef88af0264bd99ccb99d1e015c83296359320b973f0f52475cf81aa340f5b9fcb469aeacbf8e6dc0860c6c24d86823e9b71dc4facaabaf4a
-
Filesize
7.9MB
-
Filesize
1.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
1.9MB
-
Filesize
7.9MB
-
Filesize
1.9MB
-
Filesize
7.9MB
-
Filesize
1.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
1.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB