laplas | 83224bbf17e2eaad3e40aa076696d35daef0a126d7c7c8125920ff457b4de93d

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2023 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.9MB
MD5

27c3e0708804985d4f0758f873509805
SHA1

926ae820a61da9a6241ea94299edfcac963bcf78
SHA256

83224bbf17e2eaad3e40aa076696d35daef0a126d7c7c8125920ff457b4de93d
SHA512

bfca20c53257b54cbd8939bfa3023f3db10e796db0db5a3d445638d3ed73bf79d4510017f2e99470091fb20c615a82ee1d22962770ab053b94947f435aa69966
SSDEEP

49152:RQ7IJR3VJ9Ln5CI3o4U9ekXJkGB0qj5Bl+w:RZJR3VJ9VCAce45BD

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
4904	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	setup.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3252	1496	WerFault.exe	84

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	21	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4904	1496	setup.exe	87
PID 1496 wrote to memory of 4904	1496	setup.exe	87
PID 1496 wrote to memory of 4904	1496	setup.exe	87

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 832
  2⤵
  - Program crash
  PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1496 -ip 1496
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
724.9MB

MD5
8938267ab50d123845a20df96c8ff27e

SHA1
b77161f6663c0877579e5172a2b08d8c6cd70cae

SHA256
5a750c1f5d080ed6f621a23e6a0b82a8b206cbc2a72ce7383777a4ddfbea670d

SHA512
2adf2b9b4424eac6a78677a5e9ce4e6d0ab63700fd85fc7c28b11fb9555ea2f8100d7e0fc67b819da184cd69ad395e534650cfa67ae71e924d7c60d1bc07824f

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
724.9MB

MD5
8938267ab50d123845a20df96c8ff27e

SHA1
b77161f6663c0877579e5172a2b08d8c6cd70cae

SHA256
5a750c1f5d080ed6f621a23e6a0b82a8b206cbc2a72ce7383777a4ddfbea670d

SHA512
2adf2b9b4424eac6a78677a5e9ce4e6d0ab63700fd85fc7c28b11fb9555ea2f8100d7e0fc67b819da184cd69ad395e534650cfa67ae71e924d7c60d1bc07824f

Download Submit
memory/1496-134-0x00000000049B0000-0x0000000004D80000-memory.dmp

Filesize
3.8MB

Download
memory/1496-140-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-146-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-149-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-143-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-145-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-141-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-147-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-148-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-142-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-150-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-151-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-152-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-153-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-154-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/4904-155-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download