Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
10-09-2023 15:29
General
-
Target
tmp.exe
-
Size
3.0MB
-
MD5
02208e4168793ef72942aa31c1ae8642
-
SHA1
449b579d0b642ca43419c0687cc799afe5aa9194
-
SHA256
22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9
-
SHA512
f50be51f1ff3da3da34d4c819021686842d024476993031e56313fde1aded427e9e81d0cb2956c98d29839fac140597a8e1b1cbd89a58c481be70ce88ce5507f
-
SSDEEP
49152:MY5UqJTec/w5ashu/usRTe2WjCJILmGsO8ASotjEH10DwJ4mQDewL11TAjZVwyb:MYUqI5aPXZJIpsr7VrJ4zDHL11byb
Malware Config
Extracted
laplas
http://206.189.229.43
-
api_key
f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
610.9MB
MD508855533f05d849bbec8300e2281de8a
SHA186f83999fe23ba220ed041fca5ad4bd202557d71
SHA25615333940a8ac6fab18c9e2b36b6b3c2cd70e4bb0d93c80acf85cc4d7cbb1357c
SHA512e126935829c6345d82b0e1ebaee8ccefb84e3661c9dd510737e42733814829c3761a78ad28b60d0d1b072930d1910de80b18d8f708a9a35ec3dea33bc4b63790
-
Filesize
610.2MB
MD54c069e3513da98505c0a647054c51b66
SHA1bd0adadca21993bc0599610c4b872d08409e8041
SHA25645f17d93afe056fb3e202b45a72aedec835c495b70a390429fe0ba2a9551ae2e
SHA5128dd410defba3bf89d0b9f83735f1fa31e37d6bd4f9dcc80e55250eea369f45a0c89fdf4e950629ffb0b67575bf4457453cdf3bb9ab9bd1bec32507d35acf39c5
-
Filesize
9.1MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
8KB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
2.8MB
-
Filesize
9.1MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
9.1MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
8KB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
2.8MB
-
Filesize
9.1MB
-
Filesize
2.0MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB