laplas | 203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08

General

Target

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
Size

2.6MB
MD5

3f821e69fe1b38097b29ac284016858a
SHA1

3995cad76f1313243e5c8abce901876638575341
SHA256

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08
SHA512

704a799fae6f6139f9c66a1f11bff243a4381ff69028b1fc1f903c8c75d303a9769b6843c67f794c1c85dd9b10dd1c07bead63702a2f077cb467e5a50c99d5d7
SSDEEP

49152:/oLi8Bd2MIUueEcBY6rCYIvkQIIZB9mnJWUyzD8A04Z/f8I:ALi8B0MiCBbC3IIZB9cKzomZ/kI

Score

10^/10

laplas clipper evasion persistence stealer trojan

Malware Config

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes

api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exentlhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe

Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

4016 ntlhost.exe

pid	process
4016	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exentlhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exentlhost.exe

pid process

4564 203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
4016 ntlhost.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 3 Go-http-client/1.1

pid	process
4564	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
4016	ntlhost.exe

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe

description	pid	process	target process
PID 4564 wrote to memory of 4016	4564	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe	ntlhost.exe
PID 4564 wrote to memory of 4016	4564	203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe
"C:\Users\Admin\AppData\Local\Temp\203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
790.6MB

MD5
de9dc1ef221b5407525197b8a1bae472

SHA1
182baee3b43e7e02574d6bd5d42151a2afc777a2

SHA256
f291dcdcaf08cba2e4bbfcaaa637e807d73b072596b6de8eedf0b560a5b98c71

SHA512
55910028453ec284dfa3f45e1600aafde21abe5a002e25e2b94d5dc3de71763b585996ac2e44f2b46e9333ad74f8afa98f96a819b857890a7daf1cfa77cd3f97

Download Submit
memory/4016-47-0x00007FFD448E0000-0x00007FFD44ABB000-memory.dmp

Filesize
1.9MB

Download
memory/4016-49-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4016-64-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-63-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-34-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4016-61-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-60-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-33-0x00007FFD00000000-0x00007FFD00002000-memory.dmp

Filesize
8KB

Download
memory/4016-59-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-58-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-56-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-55-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-54-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-53-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-52-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-51-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-50-0x00007FFD41170000-0x00007FFD413B9000-memory.dmp

Filesize
2.3MB

Download
memory/4016-48-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-46-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-45-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-44-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-43-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-42-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-41-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-28-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-40-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-39-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-38-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-31-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4016-32-0x00007FFD41170000-0x00007FFD413B9000-memory.dmp

Filesize
2.3MB

Download
memory/4016-35-0x00007FFD00030000-0x00007FFD00031000-memory.dmp

Filesize
4KB

Download
memory/4016-62-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-37-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4016-36-0x0000000000260000-0x0000000000AC8000-memory.dmp

Filesize
8.4MB

Download
memory/4564-5-0x00007FFD00030000-0x00007FFD00031000-memory.dmp

Filesize
4KB

Download
memory/4564-18-0x00007FFD41170000-0x00007FFD413B9000-memory.dmp

Filesize
2.3MB

Download
memory/4564-8-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-29-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4564-26-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-1-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4564-23-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4564-22-0x00007FFD00000000-0x00007FFD00002000-memory.dmp

Filesize
8KB

Download
memory/4564-21-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-20-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4564-0-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-3-0x00007FFD00000000-0x00007FFD00002000-memory.dmp

Filesize
8KB

Download
memory/4564-30-0x00007FFD41170000-0x00007FFD413B9000-memory.dmp

Filesize
2.3MB

Download
memory/4564-27-0x00007FFD448E0000-0x00007FFD44ABB000-memory.dmp

Filesize
1.9MB

Download
memory/4564-9-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-15-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-14-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-17-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-12-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-11-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-10-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-16-0x00007FFD448E0000-0x00007FFD44ABB000-memory.dmp

Filesize
1.9MB

Download
memory/4564-7-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-6-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download
memory/4564-2-0x00007FFD41170000-0x00007FFD413B9000-memory.dmp

Filesize
2.3MB

Download
memory/4564-4-0x00007FFD422D0000-0x00007FFD4237E000-memory.dmp

Filesize
696KB

Download
memory/4564-13-0x0000000000DD0000-0x0000000001638000-memory.dmp

Filesize
8.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads