Analysis
- max time kernel
79s - max time network
181s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
27/11/2022, 22:16
General
- Target 82126fc4fd73e4fea6ee032f156572af9986acdc8c22f1f69253289a3b39b150.exe
- Size 5.2MB
- Sample221127-169ccsge4t
- SHA256 82126fc4fd73e4fea6ee032f156572af9986acdc8c22f1f69253289a3b39b150
Malware Config
Extracted
-
laplas
-
clipper.guru
-
api_key
c25400a81a220bbbc3cb779c59ab8b74c7b58ae3a99f465520cbd86c53bd630b
Signatures
- Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82126fc4fd73e4fea6ee032f156572af9986acdc8c22f1f69253289a3b39b150.exe"C:\Users\Admin\AppData\Local\Temp\82126fc4fd73e4fea6ee032f156572af9986acdc8c22f1f69253289a3b39b150.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\vivaca loc kevilena xatequij nocolok_gijafe meci dokinori kikojiyi\quegego fatilila voy boji.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\vivaca loc kevilena xatequij nocolok_gijafe meci dokinori kikojiyi\quegego fatilila voy boji.exe"C:\Users\Admin\vivaca loc kevilena xatequij nocolok_gijafe meci dokinori kikojiyi\quegego fatilila voy boji.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn kqZiVKBcGO /tr C:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn kqZiVKBcGO /tr C:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\82126fc4fd73e4fea6ee032f156572af9986acdc8c22f1f69253289a3b39b150.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exeC:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exe1⤵
-
C:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exeC:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exe1⤵
-
C:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exeC:\Users\Admin\AppData\Roaming\kqZiVKBcGO\IaXkWQxCbj.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
IaXkWQxCbj.exe.log
IaXkWQxCbj.exe
IaXkWQxCbj.exe
IaXkWQxCbj.exe
IaXkWQxCbj.exe
quegego fatilila voy boji.exe
quegego fatilila voy boji.exe
memory/852-405-0x00000000005D0000-0x00000000005E6000-memory.dmp
memory/1496-311-0x00000000101F0000-0x0000000012A8F000-memory.dmp
memory/1496-310-0x00000000044A0000-0x00000000049A0000-memory.dmp
memory/1496-309-0x00000000101F0000-0x0000000012A8F000-memory.dmp
memory/1496-289-0x00000000044A0000-0x00000000049A0000-memory.dmp
memory/1496-274-0x0000000002BA0000-0x0000000004498000-memory.dmp
memory/1496-248-0x0000000002BA0000-0x0000000004498000-memory.dmp
memory/2732-144-0x0000000002C20000-0x000000000451E000-memory.dmp
memory/2732-175-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-138-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-139-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-140-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-141-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-142-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-120-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-146-0x0000000004520000-0x0000000004A24000-memory.dmp
memory/2732-147-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-148-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-149-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-150-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-151-0x0000000002C20000-0x000000000451E000-memory.dmp
memory/2732-152-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-153-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-154-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-155-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-156-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-157-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-158-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-159-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-160-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-161-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-162-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-163-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-164-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-165-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-166-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-167-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-168-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-169-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-170-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-171-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-172-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-173-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-174-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-137-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-176-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-177-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-178-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-179-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-180-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-181-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-182-0x0000000004520000-0x0000000004A24000-memory.dmp
memory/2732-183-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-184-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-185-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-186-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-121-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-122-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-123-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-124-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-136-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-135-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-134-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-125-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-126-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-133-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-127-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-132-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-131-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-130-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-129-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/2732-128-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/4372-190-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/4372-189-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/4372-188-0x00000000772C0000-0x000000007744E000-memory.dmp
memory/4600-328-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/4600-343-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/4600-369-0x0000000000400000-0x00000000008CB000-memory.dmp