Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2023, 20:31

General

  • Target

    feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1.exe

  • Size

    1.9MB

  • MD5

    4c89113e9ec9f66382893b6e3b206667

  • SHA1

    d4391bcc02d5589c6c4efc3936048825a2ccbd21

  • SHA256

    feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1

  • SHA512

    349efe882aba9a626a461c02c4e431e16114a59eb916d805f7a1d3fbc2194b6c41b29757c1aa1765eac9f2b276b02ed9e66535476a9b4be7106832ce964f2b5e

  • SSDEEP

    49152:AThnaHxhnOJKQDTrrIw6miz+yQ3GsfYZJ:AoHxheDTrfiyyRsfYP

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1.exe
    "C:\Users\Admin\AppData\Local\Temp\feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Executes dropped EXE
      PID:1200
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 484
      2⤵
      • Program crash
      PID:4084
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3168 -ip 3168
    1⤵
      PID:2184

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

            Filesize

            742.1MB

            MD5

            951b29c3a7cbb0f95981076b4e70425a

            SHA1

            855a7987af162a01972b91089a807dc9d634c800

            SHA256

            b809cf746815882304eeb5e713e395abc7a95f5b2ca7e82bfd8a11b25ce40a56

            SHA512

            42cf6fc5fb8d79d63e67e15efba3967b12c91b8b935bb9df0e026b556dee15d52b1d04fc308ee89953ed52327ca109ac00c1ff4b5fc1f91dc9ffcd20f47e6f1e

          • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

            Filesize

            846.0MB

            MD5

            c644f0d0431c72a81c82399befbfd523

            SHA1

            038fe35633abfdeb17ef8bdca17458dcaeaae796

            SHA256

            f5823204a8287cb17880da972eb10f52366d9c4be85620797806741ca4b40299

            SHA512

            c609579fc2cb54558dcfe6dc320417fade3540d8124e85674daee1b1ccd443e61567e563a7407c6cb62909f8136a5842f2bfc8bef5e1ee293c1e96b719ab4828

          • memory/1200-146-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-149-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-141-0x0000000004A80000-0x0000000004E50000-memory.dmp

            Filesize

            3.8MB

          • memory/1200-157-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-144-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-145-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-156-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-147-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-148-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-155-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-151-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-152-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-153-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/1200-154-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3168-136-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3168-134-0x0000000004D60000-0x0000000005130000-memory.dmp

            Filesize

            3.8MB

          • memory/3168-142-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB