Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
04-09-2023 02:38
General
-
Target
6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904.exe
-
Size
10.0MB
-
MD5
0b9d2831ef8b3b992ccd927eacda539c
-
SHA1
4e2cce21d8b53dad540bc3cf28676436f896a32a
-
SHA256
6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904
-
SHA512
4935866c3961a14904c1b3c6fb9a141d03fa222dd9d9eb5ff1b6d6dbb22099d640454f203d052f6091c987896ba8c3c2cdd560d7c1f8bc1b52ef8f22a6a8326f
-
SSDEEP
196608:VoA+3n7KsWEQTUqX8dedyXw2peE+RE7e5pPKGuk9wc5j5VxzOql9axhqBpl34Iyd:uA+3n7WbUqaNoRE7oppukJVxzpl9arqE
Malware Config
Extracted
laplas
http://lpls.tuktuk.ug
-
api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904.exe"C:\Users\Admin\AppData\Local\Temp\6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753.0MB
MD50671d72c04a921f47ccaf97f5d5d3a51
SHA1b0c801c1a550a433e1d0ce0d11e12ef07b4524a6
SHA256c452e1fed2198d3e50eacec8a30e0d30346dd92c54162d183ede01d4710a30c8
SHA512df15e412a7cc6bc1dce576d5b8c526754c98caebbdb320f45f14a7ea57ee17742196eca45f8b4a44717bc721a3a6367a795eec395af92c46c661075156462dd2
-
Filesize
753.0MB
MD50671d72c04a921f47ccaf97f5d5d3a51
SHA1b0c801c1a550a433e1d0ce0d11e12ef07b4524a6
SHA256c452e1fed2198d3e50eacec8a30e0d30346dd92c54162d183ede01d4710a30c8
SHA512df15e412a7cc6bc1dce576d5b8c526754c98caebbdb320f45f14a7ea57ee17742196eca45f8b4a44717bc721a3a6367a795eec395af92c46c661075156462dd2
-
Filesize
8.6MB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
432KB
-
Filesize
1.7MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
1.7MB
-
Filesize
8.6MB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
1.7MB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
432KB
-
Filesize
1.7MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB