Analysis
- max time kernel
150s - max time network
327s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
06/12/2022, 04:48
General
- Target 4f62f08bff2cb9bc4ca86ba8e6a733018539392ebeacfd186de44d155f14c2d0.exe
- Size 5.8MB
- Sample221206-ffjnssce2v
- SHA256 4f62f08bff2cb9bc4ca86ba8e6a733018539392ebeacfd186de44d155f14c2d0
Malware Config
Extracted
-
laplas
-
85.192.40.41
-
api_key
8efab38a7f27af809f75b55b4fd503c9f71870a74036793686b6b48ac9d03efc
Signatures
- Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f62f08bff2cb9bc4ca86ba8e6a733018539392ebeacfd186de44d155f14c2d0.exe"C:\Users\Admin\AppData\Local\Temp\4f62f08bff2cb9bc4ca86ba8e6a733018539392ebeacfd186de44d155f14c2d0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn VUWsKjJTcg /tr C:\Users\Admin\AppData\Roaming\VUWsKjJTcg\todYmORsaw.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn VUWsKjJTcg /tr C:\Users\Admin\AppData\Roaming\VUWsKjJTcg\todYmORsaw.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\VUWsKjJTcg\todYmORsaw.exeC:\Users\Admin\AppData\Roaming\VUWsKjJTcg\todYmORsaw.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
todYmORsaw.exe
todYmORsaw.exe
memory/1560-154-0x0000000077600000-0x000000007778E000-memory.dmp
memory/1560-153-0x0000000077600000-0x000000007778E000-memory.dmp
memory/1560-152-0x0000000077600000-0x000000007778E000-memory.dmp
memory/1560-151-0x0000000077600000-0x000000007778E000-memory.dmp
memory/1560-150-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-136-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-148-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-126-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-127-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-128-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-129-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-130-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-131-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-132-0x0000000000D60000-0x0000000001A59000-memory.dmp
memory/2652-116-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-137-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-138-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-139-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-140-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-141-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-142-0x0000000000D60000-0x0000000001A59000-memory.dmp
memory/2652-143-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-144-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-145-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-146-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-147-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-172-0x0000000000D60000-0x0000000001A59000-memory.dmp
memory/2652-124-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-123-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-122-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-121-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-120-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-119-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-175-0x0000000000D60000-0x0000000001A59000-memory.dmp
memory/2652-118-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-117-0x0000000077600000-0x000000007778E000-memory.dmp
memory/2652-125-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-185-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-186-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-184-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-182-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-181-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-180-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-179-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-178-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-177-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4408-211-0x0000000000BC0000-0x00000000018B9000-memory.dmp
memory/4408-220-0x0000000000BC0000-0x00000000018B9000-memory.dmp
memory/4972-158-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-171-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-173-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-170-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-174-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-169-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-168-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-167-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-166-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-165-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-164-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-161-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-163-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-162-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-160-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-159-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-157-0x0000000077600000-0x000000007778E000-memory.dmp
memory/4972-156-0x0000000077600000-0x000000007778E000-memory.dmp