Analysis

  • max time kernel
    141s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2023, 17:50

General

  • Target

    78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe

  • Size

    296KB

  • MD5

    dca7caf645208809736db189d41dfe2a

  • SHA1

    8e2b492fbadb34a74db8d397cc463e2c0efd1526

  • SHA256

    78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b

  • SHA512

    8e16523e30f357dbf6b1e2a26efbeccea57dd47f39e16cd6e1b7aeaef94e5c0bf86cec19031b04e03c5bf14a88852dea586bd399931b68986a41e7fb54e2b0a0

  • SSDEEP

    3072:7UeWk7wDLopWdyacae1WLHP19Y7MM8RbNtghwqxHpdyOftbFuM:wr6wDLoYd2aVD99mMB5tghXeyu

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe
    "C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:236
      • C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe
        "C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Executes dropped EXE
          PID:4912
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 516
          4⤵
          • Program crash
          PID:3160
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:2156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 2104
      2⤵
      • Program crash
      PID:4552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1256 -ip 1256
    1⤵
      PID:4564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1648 -ip 1648
      1⤵
        PID:4184

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • C:\ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • C:\ProgramData\nss3.dll

              Filesize

              2.0MB

              MD5

              1cc453cdf74f31e4d913ff9c10acdde2

              SHA1

              6e85eae544d6e965f15fa5c39700fa7202f3aafe

              SHA256

              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

              SHA512

              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            • C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe

              Filesize

              1.8MB

              MD5

              d433fee70e60de32de4608f07bed7d2a

              SHA1

              8b84224c8319705317340392ad99bc529183a7db

              SHA256

              0a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7

              SHA512

              ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8

            • C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe

              Filesize

              1.8MB

              MD5

              d433fee70e60de32de4608f07bed7d2a

              SHA1

              8b84224c8319705317340392ad99bc529183a7db

              SHA256

              0a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7

              SHA512

              ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              548.4MB

              MD5

              fbded1c40623fc9b38b7d62c6c93c6b9

              SHA1

              557386c3d28d93d19d9ec8c66f5a5006742b2e39

              SHA256

              cb0e66ee3a572aa5820ea2721e1f51b9da9156436a85f33698ad07ae7344646b

              SHA512

              7e2b9b920a2d96794507165d657ade929347bfbe15b5d1f5471d0313f1dd620b28820d6e9eba78505e0678adfb8e115a4cb43e8603b4038fc763002059075c34

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              566.4MB

              MD5

              1b5b7080ee401a92d65163e153743a09

              SHA1

              6e533b0d390df8a8d0d24e7dddaff5d2398b4cce

              SHA256

              b5c8c535816ded1f128666cc69d28cec3cb621afade1a19964f02da606a2c808

              SHA512

              d1f777a05617edd0dc9f9edf28c5589b29e151635848fa5155e061a6ae4d13498cbda8dd0e70ed9bd051a99317f5fe57102abc3b4c209203d1b42452084f45b0

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              582.9MB

              MD5

              5c83c07936caa7ab1205311dd3ba8696

              SHA1

              405307b0646ac506a9045e25270276b4fa419597

              SHA256

              616cd915e0d71c9963ea57a5d75ec7d5b99c694bd4da5a340ed54861015d5878

              SHA512

              aea25fbe5d9a6cfc22bc5c7208323d9c25552a2f123278d02f2900ce93af7c62fb26df2e3b3daac26aa771f4eebef5c13f8da791e765091d692e791fafe234b5

            • memory/1256-204-0x0000000000400000-0x0000000002AFA000-memory.dmp

              Filesize

              39.0MB

            • memory/1256-211-0x0000000000400000-0x0000000002AFA000-memory.dmp

              Filesize

              39.0MB

            • memory/1256-134-0x0000000002DB0000-0x0000000002DC5000-memory.dmp

              Filesize

              84KB

            • memory/1256-202-0x0000000000400000-0x0000000002AFA000-memory.dmp

              Filesize

              39.0MB

            • memory/1256-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

              Filesize

              972KB

            • memory/1648-213-0x0000000002750000-0x0000000002B20000-memory.dmp

              Filesize

              3.8MB

            • memory/1648-215-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/1648-219-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/4912-221-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/4912-222-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/4912-223-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/4912-225-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/4912-226-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/4912-227-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB

            • memory/4912-228-0x0000000000400000-0x0000000000803000-memory.dmp

              Filesize

              4.0MB