laplas | b5eade1204ad4fb6243fecccbee72abd2bcfeb9166596d9c9996e0000feb25c1

Analysis

max time kernel
136s
max time network
145s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/03/2023, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.exe
Size 1.9MB
Sample230313-sy682aba36
SHA256 b5eade1204ad4fb6243fecccbee72abd2bcfeb9166596d9c9996e0000feb25c1
MD5 66bf3c102b942dcf11ef6fde325b0087
SHA1 a896064cf042f6659fc04b0aae3f71306c9b060a
SHA512 2774ca3d7f042de774d2f40972fc429cf8349366aabdd0a7c0a0c0ffbf70208d90547853dbbd6553592272a4ed12b1a3a9a2a906681ef229a0f4545d22ce3e3a
SSDEEP 49152:2z4bj3Op3BIHLtpYnUWyh/WbGkApj6u5a2C:2z4bbOp3BQt7fWbapjVC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1540	ntlhost.exe

Loads dropped DLL 5 IoCs

pid	Process
1604	install.exe
1604	install.exe
1540	ntlhost.exe
1540	ntlhost.exe
1540	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	install.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1540	1604	install.exe	28
PID 1604 wrote to memory of 1540	1604	install.exe	28
PID 1604 wrote to memory of 1540	1604	install.exe	28
PID 1604 wrote to memory of 1540	1604	install.exe	28
PID 1604 wrote to memory of 1540	1604	install.exe	28
PID 1604 wrote to memory of 1540	1604	install.exe	28
PID 1604 wrote to memory of 1540	1604	install.exe	28

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ntlhost.exe

Path C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 257.8MB
SHA256 d78c1693109b6e267c16c1fab780c137f14df5afc41307bc942e958759d0649d
MD5 4b0a588edb5a4dc264806417ad47fb36
SHA1 caa21560134dadbfd44ab2ec10c15ee1422b719e
SHA512 c8115606d5c3c36187083336425a0fb78c3256cf70cf98bb87917ea87b6a46e947d11fe0a7dbec4aec95db29ed3b0516eba85810efd7aef1a9f7dfc0f29bcc9b
SSDEEP 6291456:ZtHXS0LKCtzPvc5Zg5YOiQrX9qKOwemKoSyvLA:zOAU5+6oD9qpcCyvLA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 263.8MB
SHA256 4076ec98a705c007214e8c116169b85524fd1b7a86bc8e248a6f6d7d866a0138
MD5 16d3fd4d83243a94bdc340cac2b3234e
SHA1 55940156335264a728d9127f344b60ab4106f31c
SHA512 fa0afba3dbeb105374e3f0404677b3361146de9ca7ec73ed82e6cfccd775255ee432ab5cb00782e8985b2750b27e0972422ab8744891a84d800e0d18370a650b
SSDEEP 6291456:ZtHXS0LKCtzPvc5Zg5YOiQrX9qKOwemKoSyvLVJ8K3:zOAU5+6oD9qpcCyvLVJ13
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 247.4MB
SHA256 70722159aee8e328ea50483651d17a1e3268c61a4428251a8c8d2972bdcf5897
MD5 3f64a63af0d36f1211057b08ab4144f5
SHA1 6d9db7c1c0de609f58a1af3ee92a1b468ec6a76c
SHA512 9f587dd38a34a8ec000572e9a319ab1834ded15fa7f4ba9334eca1dd1d48e3f29a205aaa6956d2f2bab8a390f4fa3a0208a7c386c2e2ea6d2adc07116d3c1b1e
SSDEEP 6291456:ZtHXS0LKCtzPvc5Zg5YOiQrX9qKOwemKoSyvV:zOAU5+6oD9qpcCyvV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 150.7MB
SHA256 80615355b80d24ed51847d8100f07a3ea5c97dafc97be078b728c56b0945e650
MD5 dbaa472487b6f28e964b1dfdb7451b1d
SHA1 985645e66a8e7892584b2a1a25be807129a37ed7
SHA512 4ff394cd65d69bdc1ddde895deb842e1eaaef5a7dab45e64f5f88403e639fd3d1bb76e1fe5bfe3bad6174ef743efd4ce3eab2e4bbcbe308acdfc6119f4b11d6a
SSDEEP 3145728:fsw40o6pXS0M+K0glSyutjPPAALczSOY/gZg5CjP2JdmQUUcK9xq:ZtHXS0LKCtzPvc5Zg5YOiQrX9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 234.7MB
SHA256 9cda0eded4aa8c1237625dda524f5cababf42c269d293e10f23131c3c4853242
MD5 f9af921cb60ed714c6b95f6331e3c306
SHA1 240dc53cd9e78836d54585945da7b5245b70ff92
SHA512 18375ce3367c1f37485ae159dbad474b7aa5ec08d9bde6f948299f809f67b1e4121d534177b2868fe8acb6509c3745cbda8f960b746f9bf4e5cf8d91e7e43987
SSDEEP 6291456:ZtHXS0LKCtzPvc5Zg5YOiQrX9qKOwemKoSyvR:zOAU5+6oD9qpcCyvR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 281.0MB
SHA256 383d18feb7af2924db9377104a8c66b8a66bee904bef8700c877578c590baff4
MD5 a19a0a1d46b34bfd4569f59ab51002d7
SHA1 dedcf546f75ff8d34434a069effdec77535a5a13
SHA512 0ec0b4edc4f9f60c6ae13b5f6a64f35000b400af1d944ded4caf21b6909723ef54794e931af63774ff7b379dee0a9e5d6b13a125b9ef434dafbb0657e0018591
SSDEEP 6291456:ZtHXS0LKCtzPvc5Zg5YOiQrX9qKOwemKoSyvLVJ8Kwd:zOAU5+6oD9qpcCyvLVJ1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 249.9MB
SHA256 89eb041eee09ce1df19cc4fda461c80c936e6178fed5854d023edf12963f2c27
MD5 8b16e42f92377613f7e50f0017ebb975
SHA1 8bd79d7739b0428c6e8e287882804abc8460624c
SHA512 5acf21387fe4ee516f9051c5a406bceb4f976f64c8e770706cd6cb4296e1bb4fce6400db582cffde2849a7495bc381ae1ad380ab3e8515c5734342a88b0a8000
SSDEEP 6291456:ZtHXS0LKCtzPvc5Zg5YOiQrX9qKOwemKoSyvL5:zOAU5+6oD9qpcCyvL5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path \Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 267.1MB
SHA256 9c0a3ce050cec51ecc78e8613c74585049088d4411d4dbe106f58fe0305cc4df
MD5 6b350f8b4aca51dc5ad4c96db16e6744
SHA1 453c957fdc5f21492cc21b4c2703ebfa3e15e1e5
SHA512 a9ed636496ae11a2e7378e0cf6bcb08c1e3cdfa56c034245a1a5b4457a3a8ee739d4caa7da3aa4220172090aee0d1f073b9e31cafa2f4dc78885da1a39d34a33
SSDEEP 6291456:ZtHXS0LKCtzPvc5Zg5YOiQrX9qKOwemKoSyvLVJ8KY:zOAU5+6oD9qpcCyvLVJ1Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1540-70-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-75-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-84-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-69-0x00000000024F0000-0x000000000269A000-memory.dmp

Download

memory/1540-83-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-71-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-72-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-73-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-74-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-82-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-78-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-79-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-80-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1540-81-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1604-64-0x0000000000400000-0x00000000009F1000-memory.dmp

Download

memory/1604-54-0x0000000002400000-0x00000000025AA000-memory.dmp

Download

memory/1604-55-0x00000000025B0000-0x0000000002980000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads