laplas | e0db39d60c288d9c518acb38aaf5f6c46390c3f5784a21dcf29bed89fdfbc840

Analysis

max time kernel
90s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 12.6MB
Sample221206-wsla6aec2y
SHA256 e0db39d60c288d9c518acb38aaf5f6c46390c3f5784a21dcf29bed89fdfbc840
MD5 eeb98341163fe58e215e1ef01ee0368d
SHA1 0673dc733bee817a8a87baf88f9450c470246677
SHA512 b1cb69338581812198af7354e2113521a1ce39e7600c3851c354b9331e8229ed26b071dc5e89c33a635a99c771cf7b51a189570f0d79caa48f8de7906675fba5
SSDEEP 196608:JUsap9XiMqRvC/A8OcYXhUHSnqLmPl4qBwRhYXCR9iL23TQq:JbKK2rZiFlnBwxTQq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas raccoon 78895e6c011840533588aec93ff04720 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

78895e6c011840533588aec93ff04720

http://45.15.156.120/

rc4.plain

Extracted

Family

laplas

185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
stealer laplas
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1396	6mY9q957.exe
4548	IePNByzuQZ.exe

Loads dropped DLL 3 IoCs

pid	Process
3348	InstallUtil.exe
3348	InstallUtil.exe
3348	InstallUtil.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 3348	2128	Setup.exe	81

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1272	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	48	Go-http-client/1.1

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 2128 wrote to memory of 3348	2128	Setup.exe	81
PID 3348 wrote to memory of 1396	3348	InstallUtil.exe	82
PID 3348 wrote to memory of 1396	3348	InstallUtil.exe	82
PID 3348 wrote to memory of 1396	3348	InstallUtil.exe	82
PID 1396 wrote to memory of 1788	1396	6mY9q957.exe	88
PID 1396 wrote to memory of 1788	1396	6mY9q957.exe	88
PID 1396 wrote to memory of 1788	1396	6mY9q957.exe	88
PID 1788 wrote to memory of 1272	1788	cmd.exe	90
PID 1788 wrote to memory of 1272	1788	cmd.exe	90
PID 1788 wrote to memory of 1272	1788	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Users\Admin\AppData\Local\Temp\6mY9q957.exe
    "C:\Users\Admin\AppData\Local\Temp\6mY9q957.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C schtasks /create /tn QpuWBrjdAT /tr C:\Users\Admin\AppData\Roaming\QpuWBrjdAT\IePNByzuQZ.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn QpuWBrjdAT /tr C:\Users\Admin\AppData\Roaming\QpuWBrjdAT\IePNByzuQZ.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:1272

C:\Users\Admin\AppData\Roaming\QpuWBrjdAT\IePNByzuQZ.exe
C:\Users\Admin\AppData\Roaming\QpuWBrjdAT\IePNByzuQZ.exe
1⤵
- Executes dropped EXE
PID:4548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\Users\Admin\AppData\LocalLow\mozglue.dll
Size 612KB
SHA256 4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
MD5 f07d9977430e762b563eaadc2b94bbfa
SHA1 da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA512 6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
SSDEEP 12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\LocalLow\nss3.dll
Size 1.9MB
SHA256 c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
MD5 f67d08e8c02574cbc2f1122c53bfb976
SHA1 6522992957e7e4d074947cad63189f308a80fcf2
SHA512 2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
SSDEEP 49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\LocalLow\sqlite3.dll
Size 1.0MB
SHA256 47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
MD5 dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1 bbac1dd8a07c6069415c04b62747d794736d0689
SHA512 b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
SSDEEP 24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
MD5 SHA1 SHA512 SSDEEP

Submit Download

6mY9q957.exe

Path C:\Users\Admin\AppData\Local\Temp\6mY9q957.exe
Size 5.4MB
SHA256 cc319be00b3ac7727f2b7d55b532899be8518b2fe69588cf23e4c8e34b139155
MD5 95033406f9719a72e37ab1dc499bff86
SHA1 14796247f688b312561893955c2255aefa38ffc9
SHA512 54a2d169dd4f5c108f341bf2ea17dfd8a64dba5e0dd1d0324dabde62ee96bac584229dd218157bd2e305c2d45dc1918412a880008c5597750f985ef450da4031
SSDEEP 98304:i1uzvaiQ1TMcEGVxw8YGGagQzR0GFxhkdTG+xqWWU5TV+K2mRXtJg:wiQ1TF12mzRrdkBrwK2I9C
MD5 SHA1 SHA512 SSDEEP

Submit Download

6mY9q957.exe

Path C:\Users\Admin\AppData\Local\Temp\6mY9q957.exe
Size 5.4MB
SHA256 cc319be00b3ac7727f2b7d55b532899be8518b2fe69588cf23e4c8e34b139155
MD5 95033406f9719a72e37ab1dc499bff86
SHA1 14796247f688b312561893955c2255aefa38ffc9
SHA512 54a2d169dd4f5c108f341bf2ea17dfd8a64dba5e0dd1d0324dabde62ee96bac584229dd218157bd2e305c2d45dc1918412a880008c5597750f985ef450da4031
SSDEEP 98304:i1uzvaiQ1TMcEGVxw8YGGagQzR0GFxhkdTG+xqWWU5TV+K2mRXtJg:wiQ1TF12mzRrdkBrwK2I9C
MD5 SHA1 SHA512 SSDEEP

Submit Download

IePNByzuQZ.exe

Path C:\Users\Admin\AppData\Roaming\QpuWBrjdAT\IePNByzuQZ.exe
Size 498.8MB
SHA256 04afb54d181bdf3dc11765f4bec919ae852e14f5583a1362489d7a9a948a76cd
MD5 3a17846a200239ff8ce966447f530c4f
SHA1 17515806862f86305208a0ae3c19e65ab7f08d28
SHA512 f978dec26ae097f47d4d33c4cb089349e80c1e9d9b2b35e9766aa52bcacf9f450ff187d2f59000617b76773045c069b6b9dd0c705bfd49cd41203a26f6726eb8
SSDEEP 12582912:TuXPeujYUwhqhMa/86FhCjOJCNv6ORaXkrztMjK:hO2MhHfFhCjYev3OkrzeO
MD5 SHA1 SHA512 SSDEEP

Submit Download

IePNByzuQZ.exe

Path C:\Users\Admin\AppData\Roaming\QpuWBrjdAT\IePNByzuQZ.exe
Size 521.1MB
SHA256 44303e0d253a4969f4399108d253200ab99b8f2f0b6976a94bce40874d0fff5c
MD5 960b08ba43b31b39bcca04fbcba0e99f
SHA1 c0b5cd3be7197f1e202243e555cb9c8edfbc3bbd
SHA512 14fdd53fa5ba4541964de51685e081b7d51fd5ce940be7f4a0feac5acf24acd99b2a198aad7d6237ad6b3babd09421a071a1ad5d177fb167eba31797c4dc120a
SSDEEP 12582912:TuXPeujYUwhqhMa/86FhCjOJCNv6ORaXkrztMjdVSqz:hO2MhHfFhCjYev3Okrze/7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1396-150-0x0000000000A80000-0x000000000165A000-memory.dmp

Download

memory/2128-142-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

Download

memory/2128-135-0x0000000000BD0000-0x0000000001870000-memory.dmp

Download

memory/2128-136-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

Download

memory/3348-141-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3348-146-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3348-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3348-137-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4548-158-0x0000000000890000-0x000000000146A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads