Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2023, 23:10

General

  • Target

    fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe

  • Size

    296KB

  • MD5

    36f97cccfd413197f98b4943fbdaa875

  • SHA1

    3bb5148f4736e5f4f39807c46ad75b8997e7ce03

  • SHA256

    fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4

  • SHA512

    66171982f19800842def287d2ed0e742f687f4ca492d83111f0b601d0cb179e3a7b70928ef1de2183d7389922b49344fe239306d934dc2f101ce27b1e07b55e8

  • SSDEEP

    6144:4gHLQoCNTP523ANRNKD3xu+X9GmYLwHu:4gHkoCV5CANRNKD3o+w4Hu

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe
    "C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe
        "C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Executes dropped EXE
          PID:1412
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:3472

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\mozglue.dll

          Filesize

          593KB

          MD5

          c8fd9be83bc728cc04beffafc2907fe9

          SHA1

          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

          SHA256

          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

          SHA512

          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        • C:\ProgramData\mozglue.dll

          Filesize

          593KB

          MD5

          c8fd9be83bc728cc04beffafc2907fe9

          SHA1

          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

          SHA256

          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

          SHA512

          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        • C:\ProgramData\nss3.dll

          Filesize

          2.0MB

          MD5

          1cc453cdf74f31e4d913ff9c10acdde2

          SHA1

          6e85eae544d6e965f15fa5c39700fa7202f3aafe

          SHA256

          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

          SHA512

          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        • C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe

          Filesize

          1.9MB

          MD5

          2bf7a5a8fa98cc72f6953c835531f651

          SHA1

          284871c67b96e46064c1529119801e26e065efe3

          SHA256

          f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213

          SHA512

          38880e544b3359abbec5b7da0573d1c5371d274bae90a4541a79b590c75a5c1ecd3e15b77a937c10c0942842634a3f6b4063a4c182f91526f7f33cc790994fbe

        • C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe

          Filesize

          1.9MB

          MD5

          2bf7a5a8fa98cc72f6953c835531f651

          SHA1

          284871c67b96e46064c1529119801e26e065efe3

          SHA256

          f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213

          SHA512

          38880e544b3359abbec5b7da0573d1c5371d274bae90a4541a79b590c75a5c1ecd3e15b77a937c10c0942842634a3f6b4063a4c182f91526f7f33cc790994fbe

        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

          Filesize

          351.6MB

          MD5

          ae3fd6b0fd2fc1c899815ead54d776fc

          SHA1

          44882d8e080624250267b81075b7efcaddd4b0e7

          SHA256

          0aeb71d5879fb398931b3e70a2dfc68b25e8810bd8e73eb8441da150f17a7984

          SHA512

          5006a3be8d430f8488914d56cfa4e1e6af960ac548a4a74518fce7791c2dba141c60159115d1050dff7484e3bff89065704363c829f2322a3bc8a7b82220b06e

        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

          Filesize

          382.5MB

          MD5

          ddb727c2f3217e95953881ce5e23ae11

          SHA1

          500d3bfc22e0dd874ba5cb555fe4016f2776bda8

          SHA256

          3a3d11be21a0c5154f99ce6cc1dc169978fa184b328b7ab70b9720f442eb6429

          SHA512

          1eb5ad2360d1863b24dd965e298648d258bb93c83b743cb8bd420154a8acbb0ad78b887ffb7e3965900e750ba2cacbe81ca17e3e4b22024011f28a39c2a9700c

        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

          Filesize

          370.4MB

          MD5

          61468958d1edb0fad504ba6d6499c0a1

          SHA1

          3d546257ddc41e4202b642dbd668af6ff03d0253

          SHA256

          b54044810d7fe44aa6026f6312ff7f630ef501d567fdcfa8998908a314d8feec

          SHA512

          78cd340218f618b7cb9ae876ee9dd51c85d3fb18073ce5c5b9bd5c0f38a753e37343e39fa6d20b919069941f68b474986d45c51d71533aa0171f47fde1c3c7af

        • memory/1300-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

          Filesize

          972KB

        • memory/1300-134-0x0000000002B70000-0x0000000002B85000-memory.dmp

          Filesize

          84KB

        • memory/1300-205-0x0000000000400000-0x0000000002AFB000-memory.dmp

          Filesize

          39.0MB

        • memory/1412-221-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-223-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-230-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-218-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-219-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-229-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-222-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-228-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-224-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-225-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-226-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/1412-227-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/3704-212-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/3704-210-0x0000000004B90000-0x0000000004F60000-memory.dmp

          Filesize

          3.8MB

        • memory/3704-215-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB