Analysis
- max time kernel
144s - max time network
286s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
27/11/2022, 22:16
General
- Target 1c76b7e4eb0959b10adb0de26438ae70b64300d26437df95df5fc115f8cc57fe.exe
- Size 2.2MB
- Sample221127-16txnsgd9v
- SHA256 1c76b7e4eb0959b10adb0de26438ae70b64300d26437df95df5fc115f8cc57fe
Malware Config
Extracted
-
laplas
-
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Signatures
- Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c76b7e4eb0959b10adb0de26438ae70b64300d26437df95df5fc115f8cc57fe.exe"C:\Users\Admin\AppData\Local\Temp\1c76b7e4eb0959b10adb0de26438ae70b64300d26437df95df5fc115f8cc57fe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn jicTFBavsm /tr C:\Users\Admin\AppData\Roaming\jicTFBavsm\PNcznLwIMl.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn jicTFBavsm /tr C:\Users\Admin\AppData\Roaming\jicTFBavsm\PNcznLwIMl.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\jicTFBavsm\PNcznLwIMl.exeC:\Users\Admin\AppData\Roaming\jicTFBavsm\PNcznLwIMl.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
PNcznLwIMl.exe
PNcznLwIMl.exe
memory/316-173-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-180-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-179-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-178-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-177-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-176-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-175-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-174-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-172-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-171-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-170-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-169-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-167-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-166-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-165-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-164-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-163-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/316-162-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-139-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-122-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-144-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-145-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-146-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-147-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-148-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-149-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-150-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-152-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-151-0x00000000027F0000-0x0000000002A19000-memory.dmp
memory/2840-153-0x0000000002A20000-0x0000000002EB9000-memory.dmp
memory/2840-154-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/2840-121-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-143-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-181-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/2840-123-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-124-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-125-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-142-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-140-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-120-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-138-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-137-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-136-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-135-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-168-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/2840-134-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-133-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-132-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-129-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-131-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-130-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-128-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-127-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/2840-126-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-188-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-191-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-233-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/3856-232-0x0000000002750000-0x0000000002972000-memory.dmp
memory/3856-228-0x0000000000400000-0x00000000008CB000-memory.dmp
memory/3856-183-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-184-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-185-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-187-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-224-0x0000000002750000-0x0000000002972000-memory.dmp
memory/3856-193-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-189-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-192-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/3856-186-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/5028-160-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/5028-156-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/5028-158-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/5028-157-0x00000000772F0000-0x000000007747E000-memory.dmp
memory/5028-159-0x00000000772F0000-0x000000007747E000-memory.dmp