Analysis
- max time kernel
236s - max time network
368s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
13/12/2022, 05:02
General
- Target 5c621f82d8a4230e0a3c5f7ea2ade089cb6833b8e79e9ac98282ad404e32e0af.exe
- Size 652.4MB
- Sample221213-fpfcqsge2x
- SHA256 5c621f82d8a4230e0a3c5f7ea2ade089cb6833b8e79e9ac98282ad404e32e0af
Malware Config
Extracted
-
laplas
-
clipper.guru
-
api_key
b5f27c37558531cf78bce8922773aaa833cdccae51258e138ceb788888acb88d
Signatures
- Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c621f82d8a4230e0a3c5f7ea2ade089cb6833b8e79e9ac98282ad404e32e0af.exe"C:\Users\Admin\AppData\Local\Temp\5c621f82d8a4230e0a3c5f7ea2ade089cb6833b8e79e9ac98282ad404e32e0af.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4792-116-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-117-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-118-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-119-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-120-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-121-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-122-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-124-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-125-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-123-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-127-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-126-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-128-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-129-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-130-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-131-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-132-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-133-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-134-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-135-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-136-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-137-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-139-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-140-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-143-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-144-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-146-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-147-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-149-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-150-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-148-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-145-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-142-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-141-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-138-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-151-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-152-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-153-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-154-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-155-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-156-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-157-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-158-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-159-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-160-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-162-0x0000000002B20000-0x0000000002D11000-memory.dmp
memory/4792-161-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-163-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-164-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-165-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-166-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-167-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-168-0x00000000777D0000-0x000000007795E000-memory.dmp
memory/4792-169-0x0000000003670000-0x0000000003B3C000-memory.dmp
memory/4792-170-0x0000000003670000-0x0000000003B3C000-memory.dmp