laplas | 6d8a49a97882ab8810f740302d2fb6a59b4670e341c636dbdd1a0507de7e0334

Analysis

max time kernel
60s
max time network
132s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 879KB
Sample221127-13ctzscd72
SHA256 6d8a49a97882ab8810f740302d2fb6a59b4670e341c636dbdd1a0507de7e0334
MD5 c3ff6ba48a804d68c76f303c56c2bf2f
SHA1 4f5ba05497d117689910358678c60e4acd25a735
SHA512 55c53877baa02c4cfd6e4f52cf4df12fd5c501fb9562b304e54830f93f63549e28b327a9cf4fd32dc03ab573e0adebd46744ac0b853faf25ddbfea421373c184
SSDEEP 24576:T8Z8EMg45Pq1LQKeZuxbPhSU6/HAklxGjvhZLT:g215PHlslpSt/HVKLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas stealer

Malware Config

Extracted

Family

laplas

79.137.206.137

Attributes

api_key
0f183cb4288647960d1c458ed8456bf6524ebfbc16ebc53caab66c2376fd0eef

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
stealer laplas
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1516	pixcxtmcwapastyv.exe
1460	FRWxXtyVnj.exe

Loads dropped DLL 6 IoCs

pid	Process
1896	vbc.exe
1896	vbc.exe
1896	vbc.exe
1896	vbc.exe
1896	vbc.exe
1896	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1896	2016	Setup.exe	27

Program crash 2 IoCs

pid	pid_target	Process	procid_target
936	2016	WerFault.exe	25
1384	1896	WerFault.exe	27

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1972	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	19	Go-http-client/1.1

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1896	2016	Setup.exe	27
PID 2016 wrote to memory of 1896	2016	Setup.exe	27
PID 2016 wrote to memory of 1896	2016	Setup.exe	27
PID 2016 wrote to memory of 1896	2016	Setup.exe	27
PID 2016 wrote to memory of 1896	2016	Setup.exe	27
PID 2016 wrote to memory of 1896	2016	Setup.exe	27
PID 2016 wrote to memory of 936	2016	Setup.exe	28
PID 2016 wrote to memory of 936	2016	Setup.exe	28
PID 2016 wrote to memory of 936	2016	Setup.exe	28
PID 2016 wrote to memory of 936	2016	Setup.exe	28
PID 1896 wrote to memory of 1516	1896	vbc.exe	31
PID 1896 wrote to memory of 1516	1896	vbc.exe	31
PID 1896 wrote to memory of 1516	1896	vbc.exe	31
PID 1896 wrote to memory of 1516	1896	vbc.exe	31
PID 1516 wrote to memory of 1180	1516	pixcxtmcwapastyv.exe	32
PID 1516 wrote to memory of 1180	1516	pixcxtmcwapastyv.exe	32
PID 1516 wrote to memory of 1180	1516	pixcxtmcwapastyv.exe	32
PID 1516 wrote to memory of 1180	1516	pixcxtmcwapastyv.exe	32
PID 1180 wrote to memory of 1972	1180	cmd.exe	34
PID 1180 wrote to memory of 1972	1180	cmd.exe	34
PID 1180 wrote to memory of 1972	1180	cmd.exe	34
PID 1180 wrote to memory of 1972	1180	cmd.exe	34
PID 1896 wrote to memory of 1384	1896	vbc.exe	35
PID 1896 wrote to memory of 1384	1896	vbc.exe	35
PID 1896 wrote to memory of 1384	1896	vbc.exe	35
PID 1896 wrote to memory of 1384	1896	vbc.exe	35
PID 992 wrote to memory of 1460	992	taskeng.exe	37
PID 992 wrote to memory of 1460	992	taskeng.exe	37
PID 992 wrote to memory of 1460	992	taskeng.exe	37
PID 992 wrote to memory of 1460	992	taskeng.exe	37

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\pixcxtmcwapastyv.exe
    "pixcxtmcwapastyv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C schtasks /create /tn RYplbyBDUW /tr C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn RYplbyBDUW /tr C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 1404
    3⤵
    - Program crash
    PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 288
  2⤵
  - Program crash
  PID:936

C:\Windows\system32\taskeng.exe
taskeng.exe {4E0ADC99-D6BF-4D31-898F-0C9A47FEBD09} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
  C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
  2⤵
  - Executes dropped EXE
  PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pixcxtmcwapastyv.exe

Path C:\Users\Admin\AppData\Local\Temp\pixcxtmcwapastyv.exe
Size 4.6MB
SHA256 3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25
MD5 21f79006cf7560986de8ec8a60998894
SHA1 b4e170268721f7ddfb33c2cb5af3f953a0f16278
SHA512 f794f98972f9a7ee2cf5ee9541db8f83d6670cea95289dd8f55a52d576b2fdce58136d21b85f278ca28e545c522efecaea6529736ca89e62f8f596bd102f5615
SSDEEP 49152:rB3pvIEnEFeJAzS3Z1vAaE5FKY/t7mWcz64tVD2uCLfP5/xfKopX8Lh1eFY2xMQe:lZAxD23ZVWczxVCN/FGTQW81
MD5 SHA1 SHA512 SSDEEP

Submit Download

pixcxtmcwapastyv.exe

Path C:\Users\Admin\AppData\Local\Temp\pixcxtmcwapastyv.exe
Size 4.6MB
SHA256 3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25
MD5 21f79006cf7560986de8ec8a60998894
SHA1 b4e170268721f7ddfb33c2cb5af3f953a0f16278
SHA512 f794f98972f9a7ee2cf5ee9541db8f83d6670cea95289dd8f55a52d576b2fdce58136d21b85f278ca28e545c522efecaea6529736ca89e62f8f596bd102f5615
SSDEEP 49152:rB3pvIEnEFeJAzS3Z1vAaE5FKY/t7mWcz64tVD2uCLfP5/xfKopX8Lh1eFY2xMQe:lZAxD23ZVWczxVCN/FGTQW81
MD5 SHA1 SHA512 SSDEEP

Submit Download

FRWxXtyVnj.exe

Path C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
Size 333.6MB
SHA256 a3e05b348a326b6cb09855a3451882135e52e23c231f8b8decb4a68eba410ebe
MD5 56feb667d2c710d8bd1fcf1d4dbeb8a3
SHA1 ec82e635f1ee312196617237db6e3a3e5fcb7e05
SHA512 573ff6b43000e2f855d6e9c9168235848e10262e7f1126315070f0093a6fe558da6e6f94f9452cc24a28872e2adb7a6a8898662e3ccd366267b44fbfe02498ff
SSDEEP 6291456:eimeux9lGrsuE5Mbco3gNOiqnE2KlrR1Hkcr/9utYXjG6Sd:OHPor7S6JYOipTvHKtYXHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

FRWxXtyVnj.exe

Path C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
Size 333.6MB
SHA256 a3e05b348a326b6cb09855a3451882135e52e23c231f8b8decb4a68eba410ebe
MD5 56feb667d2c710d8bd1fcf1d4dbeb8a3
SHA1 ec82e635f1ee312196617237db6e3a3e5fcb7e05
SHA512 573ff6b43000e2f855d6e9c9168235848e10262e7f1126315070f0093a6fe558da6e6f94f9452cc24a28872e2adb7a6a8898662e3ccd366267b44fbfe02498ff
SSDEEP 6291456:eimeux9lGrsuE5Mbco3gNOiqnE2KlrR1Hkcr/9utYXjG6Sd:OHPor7S6JYOipTvHKtYXHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path \Users\Admin\AppData\Local\Temp\freebl3.dll
Size 669KB
SHA256 a5396eba9d0564f4bcbafd5a8c4a4019b4b50a5c70a42aef5491a230d21f2922
MD5 ed6249f72ba742802b2fa3ef20900d18
SHA1 6e50eec3f0b13ff71f86ffc46cf7a1d079381bf3
SHA512 6da4cd5642becef120dbde2d070332d08bf5779bc0ffe66bf3cc51ca13db5619ee0b4f8fe3bc897c1876614a2512b2598f5d1c372764dd18b474081004d87c98
SSDEEP 12288:ggPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UNo:ggPbPp9NNP0BgInfW2WMC4M+hx
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \Users\Admin\AppData\Local\Temp\mozglue.dll
Size 627KB
SHA256 bcbf8c8ba4386b7716d5481ef9d089b9448990736d3eebdcfa611a09045c3ec3
MD5 5d59e053d45049ffb8c6c08d8944e30c
SHA1 292f748d5e326143c3233e9d290087337700d606
SHA512 0f8b1c9c30d7b71fb7560377e5895c7bd15d71928c34465b1dde31ae770b6d38d5bac4d34ef4add9e08b72f2b9ea53958f167b0690fa0731af205528512a987b
SSDEEP 12288:G1AVJGFeaY9FS6ogHKMImgqt6r7BYQDishI9bBiE2ARnrYprL:xVJqe19FSpgHKtAQBYQ2TiE2ARn6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \Users\Admin\AppData\Local\Temp\nss3.dll
Size 2.0MB
SHA256 0bce97e8f6cc435250fb6aea0441e4146c7c8f8d90a9b1e76dfabd8701bfd882
MD5 05ed4ffbf6b785750d2cdacca9287f10
SHA1 579c656536ce9cd076fc790cf443caf3a8db5b8f
SHA512 dddabf3ab629ec5b15e879f90d5f9bb69d6a8b47222989d3e683cbc8a6d4072740a5c5db05952d236529dfdde645990d21a4a9b32c4419ace9e2fe409fce4f01
SSDEEP 49152:fHhQX/2LasA4/BHeCvst/tVJZn8V0c0qRy:fHhQv2TB+4sPJF8V0c0Uy
MD5 SHA1 SHA512 SSDEEP

Submit Download

pixcxtmcwapastyv.exe

Path \Users\Admin\AppData\Local\Temp\pixcxtmcwapastyv.exe
Size 4.6MB
SHA256 3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25
MD5 21f79006cf7560986de8ec8a60998894
SHA1 b4e170268721f7ddfb33c2cb5af3f953a0f16278
SHA512 f794f98972f9a7ee2cf5ee9541db8f83d6670cea95289dd8f55a52d576b2fdce58136d21b85f278ca28e545c522efecaea6529736ca89e62f8f596bd102f5615
SSDEEP 49152:rB3pvIEnEFeJAzS3Z1vAaE5FKY/t7mWcz64tVD2uCLfP5/xfKopX8Lh1eFY2xMQe:lZAxD23ZVWczxVCN/FGTQW81
MD5 SHA1 SHA512 SSDEEP

Submit Download

pixcxtmcwapastyv.exe

Path \Users\Admin\AppData\Local\Temp\pixcxtmcwapastyv.exe
Size 4.6MB
SHA256 3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25
MD5 21f79006cf7560986de8ec8a60998894
SHA1 b4e170268721f7ddfb33c2cb5af3f953a0f16278
SHA512 f794f98972f9a7ee2cf5ee9541db8f83d6670cea95289dd8f55a52d576b2fdce58136d21b85f278ca28e545c522efecaea6529736ca89e62f8f596bd102f5615
SSDEEP 49152:rB3pvIEnEFeJAzS3Z1vAaE5FKY/t7mWcz64tVD2uCLfP5/xfKopX8Lh1eFY2xMQe:lZAxD23ZVWczxVCN/FGTQW81
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path \Users\Admin\AppData\Local\Temp\softokn3.dll
Size 251KB
SHA256 c10801dba6c50237dba700fe2be920f091792e45c32e00db7c63c2c19a35f3a5
MD5 3a59b504f6c41324b0d6cb6edbe3ad61
SHA1 2b3aff110badd913d221605d2f01638473dc5756
SHA512 56c9b7d4afcf8666aedaf55f819b799f2d84bc0736e0c431973114ae760da57209041785b7894f8b6d8d3e70bf040db68f7a95fcbb419fb6c44b70266eecc02d
SSDEEP 6144:gkFiy/LuRT3AuP2mzXP0vKlcKsvzg1mJr5fr3cM16+0/bQaz5jckXinisYz+xnPX:gkMy/LuRTwuPFXPAKlak1CzcMVHxYz+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1896-74-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1896-65-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/1896-89-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1896-90-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1896-57-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/1896-55-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads