Analysis
- max time kernel
151s - max time network
288s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
19/12/2022, 03:40
General
- Target 3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f.exe
- Size 8.6MB
- Sample221219-d8h7maeb69
- SHA256 3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f
Malware Config
Extracted
-
laplas
-
clipper.guru
-
api_key
dd611369e3344bc4aad751531e739d725fb32f33363f67a0bf7a4ea33213af63
Signatures
- Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f.exe"C:\Users\Admin\AppData\Local\Temp\3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn CthDkNHxan /tr C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn CthDkNHxan /tr C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exeC:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
SIAEwHQlys.exe
SIAEwHQlys.exe
memory/1996-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-184-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-183-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-182-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-218-0x00000000003F0000-0x00000000014B3000-memory.dmp
memory/1996-207-0x00000000003F0000-0x00000000014B3000-memory.dmp
memory/1996-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/1996-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2100-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2100-150-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2100-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2100-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2100-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-160-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-153-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-157-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/2456-159-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-145-0x0000000000AC0000-0x0000000001B83000-memory.dmp
memory/3824-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-171-0x0000000000AC0000-0x0000000001B83000-memory.dmp
memory/3824-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-128-0x0000000000AC0000-0x0000000001B83000-memory.dmp
memory/3824-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp
memory/3824-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp