Analysis

  • max time kernel
    269s
  • max time network
    280s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    30-07-2023 04:47

General

  • Target

    26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe

  • Size

    3.4MB

  • MD5

    9cc8c2df003851e7a8fd1ffb8386eb5f

  • SHA1

    917bf018cd62ddf5dd4f4d1709451901204b90a2

  • SHA256

    26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc

  • SHA512

    6ea0e39be36c3fd70bdc7367c7a3e2e2f85426f30f7922d8dc53567bc8a068612db4f81714c356bf418240adb8fd845b3715029335bee9692167d60cf151576a

  • SSDEEP

    49152:ZCfCy+NPnKB9iN5zR6goQk9O1x5gIhodeeLMTnGdJaoYB+rkB4JtIiMj3q9/Yy:qiKB9GZ+O1xPWeDGdJ/YB+sCM+9/Yy

Malware Config

Extracted

Family

laplas

C2

http://185.209.161.89

Attributes
  • api_key

    6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe
    "C:\Users\Admin\AppData\Local\Temp\26d701422ad9fcb12ec3bf5efa2ce6df83e425cfcd61c6c393c4aaad3a46b7cc.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    748.4MB

    MD5

    0b48380ae7ff9e2fb79012099197207b

    SHA1

    9b2329dee7e45b4ed458214b92e9bb21676f6c5e

    SHA256

    83093c28df38bfec68da27fdb6314e189f6ce5eaeea605e65831840f69ab8916

    SHA512

    d1fea4f2d00d8ec314756f111c3eec86b1118133c0771dedaf1c64d015ee1b609ea0c5cc05b9e5a388346e54af2f520b80814a908eaba3b58ba5858d085d808e

  • \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    748.4MB

    MD5

    0b48380ae7ff9e2fb79012099197207b

    SHA1

    9b2329dee7e45b4ed458214b92e9bb21676f6c5e

    SHA256

    83093c28df38bfec68da27fdb6314e189f6ce5eaeea605e65831840f69ab8916

    SHA512

    d1fea4f2d00d8ec314756f111c3eec86b1118133c0771dedaf1c64d015ee1b609ea0c5cc05b9e5a388346e54af2f520b80814a908eaba3b58ba5858d085d808e

  • memory/2856-54-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-55-0x0000000077640000-0x00000000777E9000-memory.dmp

    Filesize

    1.7MB

  • memory/2856-56-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-57-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-58-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-59-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-60-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-61-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-64-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-65-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-63-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-62-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-70-0x0000000028840000-0x000000002902D000-memory.dmp

    Filesize

    7.9MB

  • memory/2856-73-0x0000000077640000-0x00000000777E9000-memory.dmp

    Filesize

    1.7MB

  • memory/2856-72-0x00000000013B0000-0x0000000001B9D000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-74-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-75-0x0000000077640000-0x00000000777E9000-memory.dmp

    Filesize

    1.7MB

  • memory/2896-76-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-77-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-79-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-78-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-80-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-81-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-82-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-83-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-84-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-85-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-86-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-87-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-88-0x0000000077640000-0x00000000777E9000-memory.dmp

    Filesize

    1.7MB

  • memory/2896-89-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-90-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-91-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-94-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-95-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-96-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-97-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-98-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-99-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-100-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-101-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-102-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-103-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-104-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-105-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-106-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-107-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-108-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-109-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-110-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-111-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-112-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-113-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-114-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-115-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB

  • memory/2896-116-0x00000000009E0000-0x00000000011CD000-memory.dmp

    Filesize

    7.9MB