laplas | 589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344

Analysis

max time kernel
284s
max time network
276s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe
Size

3.5MB
MD5

062fe47e8efc9041880ed273eda7c8f3
SHA1

b77fffa5fce64689758a7180477ffa25bd62f509
SHA256

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344
SHA512

67a4536375b34d77b3e61314ab5a6ffbbab11ff5bc4e2dd62c4b141f2b8727aef93438fd0ac74a60b55da92d54e40ee2868a9cacb2e80a60061d324940f5cb80
SSDEEP

98304:Qs1IP7M+tBbnp5KsWEjGnT6iWB7cXWvdeMl+0WyC6oxgfMapH:VoA+3n7KsWEQTUqX8dedyXw2pH

Score

10^/10

laplas clipper evasion persistence stealer trojan

Malware Config

Extracted

Family

laplas

http://lpls.tuktuk.ug

Attributes

api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ntlhost.exe589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe

Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

2644 ntlhost.exe
Loads dropped DLL 1 IoCs

Processes:

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

pid process

3008 589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

pid	process
2644	ntlhost.exe

pid	process
3008	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exentlhost.exe

pid process

3008 589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe
2644 ntlhost.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 3 Go-http-client/1.1

pid	process
3008	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe
2644	ntlhost.exe

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe

description	pid	process	target process
PID 3008 wrote to memory of 2644	3008	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe	ntlhost.exe
PID 3008 wrote to memory of 2644	3008	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe	ntlhost.exe
PID 3008 wrote to memory of 2644	3008	589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe
"C:\Users\Admin\AppData\Local\Temp\589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3008

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
750.5MB

MD5
080bb63d2d1698491abe09a37e170578

SHA1
85d6ed73cea3094cf6bac80d53a7f1b06d76635a

SHA256
cff2e31f78361b2e0692644fab12c71965f70618079b4f56ace8583e5735c1f5

SHA512
e393854994e6c18e689042e7f93d8357568fba21c0f8c2214b575bc25db55a1eb8831529bf14133956fb58db18baa8848c0116c5992d74296bf4714b8d835b65

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
750.5MB

MD5
080bb63d2d1698491abe09a37e170578

SHA1
85d6ed73cea3094cf6bac80d53a7f1b06d76635a

SHA256
cff2e31f78361b2e0692644fab12c71965f70618079b4f56ace8583e5735c1f5

SHA512
e393854994e6c18e689042e7f93d8357568fba21c0f8c2214b575bc25db55a1eb8831529bf14133956fb58db18baa8848c0116c5992d74296bf4714b8d835b65

Download Submit
memory/2644-58-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-61-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-78-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-77-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-76-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-39-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-41-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-74-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-73-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-72-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-71-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-70-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-69-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-68-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-67-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-66-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-65-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-64-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-63-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-62-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-60-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-59-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-55-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-54-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-53-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-29-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-30-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/2644-31-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/2644-32-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/2644-33-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/2644-34-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/2644-35-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2644-37-0x000007FE80010000-0x000007FE80011000-memory.dmp

Filesize
4KB

Download
memory/2644-36-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-38-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-40-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-52-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-75-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-45-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-43-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-44-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-42-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-46-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-47-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/2644-48-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-49-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/2644-50-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/2644-51-0x0000000001000000-0x0000000001898000-memory.dmp

Filesize
8.6MB

Download
memory/3008-24-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-0-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-7-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-27-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/3008-28-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/3008-1-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/3008-26-0x00000000286F0000-0x0000000028F88000-memory.dmp

Filesize
8.6MB

Download
memory/3008-15-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-2-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/3008-21-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-20-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-4-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/3008-17-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/3008-16-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-3-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/3008-14-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-13-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-12-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-11-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-10-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-9-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-8-0x0000000000C30000-0x00000000014C8000-memory.dmp

Filesize
8.6MB

Download
memory/3008-6-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/3008-5-0x000007FE80010000-0x000007FE80011000-memory.dmp

Filesize
4KB

Download
memory/3008-18-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download