Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
04-09-2023 02:38
General
-
Target
6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904.exe
-
Size
10.0MB
-
MD5
0b9d2831ef8b3b992ccd927eacda539c
-
SHA1
4e2cce21d8b53dad540bc3cf28676436f896a32a
-
SHA256
6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904
-
SHA512
4935866c3961a14904c1b3c6fb9a141d03fa222dd9d9eb5ff1b6d6dbb22099d640454f203d052f6091c987896ba8c3c2cdd560d7c1f8bc1b52ef8f22a6a8326f
-
SSDEEP
196608:VoA+3n7KsWEQTUqX8dedyXw2peE+RE7e5pPKGuk9wc5j5VxzOql9axhqBpl34Iyd:uA+3n7WbUqaNoRE7oppukJVxzpl9arqE
Malware Config
Extracted
laplas
http://lpls.tuktuk.ug
-
api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904.exe"C:\Users\Admin\AppData\Local\Temp\6cb68a9436555db343231d87302b29660a80a41a8e0139ad9bd67010efa8d904.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
693.0MB
MD5e61a90167b869f808cdb578e49a80287
SHA1f5276dcb36c9ae8d106c736c18575d4a1882f2d8
SHA256cc8a1b26aeb33ba6abd738afc8840bdcf42632cf1816f0d74242f518c7100d0c
SHA512c2524698466a492459d01caa52b7e4c9cdded96a87e3cc31b2c5d0725afb8f5470ff3dc3a47f9c302910431bf13afa79e05f4d1e668c4b80a52900162164a2ff
-
Filesize
661.3MB
MD5fd760d8c0b05da9a30d9c66a8f86e28a
SHA1bf0e46e49f94f99b6b619425740cee03b1a9a27a
SHA256d305088d47fa40e15fc4bc6f613e2f6f395dcac5bdb0cc08c341ae50bfd2c756
SHA512c7950c82304c360947213e648cc8c2ec872d415915d94a303f0af450e1de75e4eaba62ff658576beb7c5de3f1ad03aacfbeb807afe19c5c01c3f1fa6f85773ba
-
Filesize
8.6MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
8.6MB
-
Filesize
8KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
2.8MB
-
Filesize
8.6MB
-
Filesize
2.0MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB