laplas | 3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f

Analysis

max time kernel
110s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2022, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2160b328dfdbbe8080a40f80ae87af73.exe
Size 8.6MB
Sample221219-kceynahf21
SHA256 3fc2b54f096ed132efadac0b097ebf55c867e346f5685588981f40310997452f
MD5 2160b328dfdbbe8080a40f80ae87af73
SHA1 2577334ab8183268e78221adad7b681440b180a6
SHA512 d2238ede6db9268f6365f18a095158c1862faaa28f84f4dc3b6295aab97b5ce9167d449dc52457a2a42eaccf46bbdae7a82b3cad6fa99ad79900fb41d1c3652b
SSDEEP 196608:hT73/ahrYWuQouogKsCuo5aKmU/FkcDrhwJb2No+dFBP6:hT73/azo91la6/Fkcn+0o+dF16
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas stealer

Malware Config

Extracted

Family

laplas

clipper.guru

Attributes

api_key
dd611369e3344bc4aad751531e739d725fb32f33363f67a0bf7a4ea33213af63

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
stealer laplas

Executes dropped EXE 1 IoCs

pid	Process
3468	SIAEwHQlys.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
240	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	35	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4440	2160b328dfdbbe8080a40f80ae87af73.exe
4440	2160b328dfdbbe8080a40f80ae87af73.exe
3468	SIAEwHQlys.exe
3468	SIAEwHQlys.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 1504	4440	2160b328dfdbbe8080a40f80ae87af73.exe	85
PID 4440 wrote to memory of 1504	4440	2160b328dfdbbe8080a40f80ae87af73.exe	85
PID 4440 wrote to memory of 1504	4440	2160b328dfdbbe8080a40f80ae87af73.exe	85
PID 1504 wrote to memory of 240	1504	cmd.exe	87
PID 1504 wrote to memory of 240	1504	cmd.exe	87
PID 1504 wrote to memory of 240	1504	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\2160b328dfdbbe8080a40f80ae87af73.exe
"C:\Users\Admin\AppData\Local\Temp\2160b328dfdbbe8080a40f80ae87af73.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn CthDkNHxan /tr C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn CthDkNHxan /tr C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:240

C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe
C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SIAEwHQlys.exe

Path C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe
Size 571.0MB
SHA256 ae1dfa075df4f634e1168ce64e0834b1be8bb2ce7f6ed3dc54c8ef6b65420255
MD5 eee4aa320d793527578e8eb3edc4c985
SHA1 d31a117c35b5fd2ae7cbae924b817c7a8400eb87
SHA512 890f620955fac722a2a9e391d42d185f9aed917ebe1fade5f154133572a8bdd9d0015418b9988392fe2fe43dd0e60215202f84f6ddf44663305ff559e44f0c92
SSDEEP 12582912:ba672H0xs2+VYFop9LijXBL7fn9v6IrhgPRCfvbo3TMJpm5B32:bXbm2dopFiTBL7Nprhg5Cf83Q/mS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SIAEwHQlys.exe

Path C:\Users\Admin\AppData\Roaming\CthDkNHxan\SIAEwHQlys.exe
Size 571.8MB
SHA256 efe8c369b6456e00f871cd7bc9472565ab98ab91387c399f28adfec8d3c46a74
MD5 49b392c0eeb4d0f71580b0ade87208fe
SHA1 41e72caeba04a52b4e1670ce8763d8183fc56df3
SHA512 86048770afab0fce2fbd1c694a5f1b43b5209ee89fe0030d77621cdb2535e4d2896324ca43bb30f78aa49bd3acf416b71237f59e3c74bacae1b18427a8f4b548
SSDEEP 12582912:ba672H0xs2+VYFop9LijXBL7fn9v6IrhgPRCfvbo3TMJpm5B3w:bXbm2dopFiTBL7Nprhg5Cf83Q/mM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3468-142-0x0000000000FC0000-0x0000000002083000-memory.dmp

Download

memory/3468-143-0x0000000000FC0000-0x0000000002083000-memory.dmp

Download

memory/3468-147-0x0000000000FC0000-0x0000000002083000-memory.dmp

Download

memory/4440-132-0x0000000000250000-0x0000000001313000-memory.dmp

Download

memory/4440-136-0x0000000000250000-0x0000000001313000-memory.dmp

Download

memory/4440-139-0x0000000000250000-0x0000000001313000-memory.dmp

Download