Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2023, 00:50

General

  • Target

    ddb0eb49fbaccec15aa023cd0e3f184b431ceccad615cdaf419c8dde6f4ee0f5.exe

  • Size

    296KB

  • MD5

    2d0ff729a0706fe1eb506aa58e1dd1b7

  • SHA1

    62c8fdd0f95bd931002983353250d75c8dd44846

  • SHA256

    ddb0eb49fbaccec15aa023cd0e3f184b431ceccad615cdaf419c8dde6f4ee0f5

  • SHA512

    b42ae1d0e644365ea265403758bcd34aa8d7161de92abf3b9528ba6ab0abc9ebd599520391dae001eb28734f9415ba3ab41914f11fb6fe34cd732f53a53770d1

  • SSDEEP

    3072:ItLdg8LGpGDtURqx2+wz3oKrGd+ldA+pnd+pvX58mzt/fE6ihu:kg8LGIDtURHoKrHzAYd+pGR68u

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddb0eb49fbaccec15aa023cd0e3f184b431ceccad615cdaf419c8dde6f4ee0f5.exe
    "C:\Users\Admin\AppData\Local\Temp\ddb0eb49fbaccec15aa023cd0e3f184b431ceccad615cdaf419c8dde6f4ee0f5.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JKEGHDGHCG.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Users\Admin\AppData\Local\Temp\JKEGHDGHCG.exe
        "C:\Users\Admin\AppData\Local\Temp\JKEGHDGHCG.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4224
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Executes dropped EXE
          PID:1088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 468
          4⤵
          • Program crash
          PID:4060
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ddb0eb49fbaccec15aa023cd0e3f184b431ceccad615cdaf419c8dde6f4ee0f5.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:892
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:2980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 2216
      2⤵
      • Program crash
      PID:1300
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 900 -ip 900
    1⤵
      PID:1452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4224 -ip 4224
      1⤵
        PID:2096

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • C:\ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • C:\ProgramData\nss3.dll

              Filesize

              2.0MB

              MD5

              1cc453cdf74f31e4d913ff9c10acdde2

              SHA1

              6e85eae544d6e965f15fa5c39700fa7202f3aafe

              SHA256

              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

              SHA512

              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            • C:\Users\Admin\AppData\Local\Temp\JKEGHDGHCG.exe

              Filesize

              1.9MB

              MD5

              b5ddb8ef8e4c2d6794ea20684387c71e

              SHA1

              845c7315887330fe61714dcdbea413dd6ba5a049

              SHA256

              00d3cd08ccbd51f7e9c5c186c101494281413e0d5f6afea753e025aa6eac388e

              SHA512

              c3cfdb5ade38bbd074671cb889a59cedcd35d6b85866e917fb4e7bfe659d6ec2126c14bef31b1099464ae5ba4644e21599172a9c2d3da921808b066e11cf846c

            • C:\Users\Admin\AppData\Local\Temp\JKEGHDGHCG.exe

              Filesize

              1.9MB

              MD5

              b5ddb8ef8e4c2d6794ea20684387c71e

              SHA1

              845c7315887330fe61714dcdbea413dd6ba5a049

              SHA256

              00d3cd08ccbd51f7e9c5c186c101494281413e0d5f6afea753e025aa6eac388e

              SHA512

              c3cfdb5ade38bbd074671cb889a59cedcd35d6b85866e917fb4e7bfe659d6ec2126c14bef31b1099464ae5ba4644e21599172a9c2d3da921808b066e11cf846c

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              641.2MB

              MD5

              fc0b7197c3f7ca31582154325b3d8e35

              SHA1

              4ecd2ab28bff36d0c5f1ac943a3cd8ca8935016b

              SHA256

              3f677e8eb11bafd95de30d26e5b4cbfa15d4ae271865d273bd9928e075669c6d

              SHA512

              f1514b9558791bd71934f182ddcdc55932dcb8896dfac78e299f76da3a1eb4a3462dfb3565c39aac434b1116065b29c71f2f4baff3c9f407779cb75d51a4d034

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              536.2MB

              MD5

              29ed0eed099112f3841e8d061d05a88e

              SHA1

              fb78732acd573d28cac1df54b8acf41cacd1b669

              SHA256

              634a85f71f9e4bef34dd632df3d055703129be15d4595a5000adb0c74cd90ae4

              SHA512

              7c4edc0b1b62b2156de1d356f2c4de9170227b6cb01258036f5a2c4941060665593f044b90dbb47da7fe3445898b2042c79ed0670387312ad0c3a1a883174425

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              576.1MB

              MD5

              fc9a14f10ee25ad3dcccbb1375cf4902

              SHA1

              7d45771fb46731fd08faa89287c61cbd6edbcc8a

              SHA256

              d370b9b7212b870a40241a6badb366f3a2f26894877b2955905f659e2af58b2e

              SHA512

              9f37b901bf1959efccb2963b1a236fe2a9b3a81998816e89b7c37a372834703ebf1ca9143be856bdd9de44a150eb9778532a9a87f1437c3db8307b4f7adadfa8

            • memory/900-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

              Filesize

              972KB

            • memory/900-223-0x0000000000400000-0x0000000002AFB000-memory.dmp

              Filesize

              39.0MB

            • memory/900-134-0x0000000002C50000-0x0000000002C65000-memory.dmp

              Filesize

              84KB

            • memory/1088-233-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-236-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-244-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-231-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-232-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-243-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-235-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-242-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-237-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-238-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-239-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-240-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/1088-241-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4224-222-0x0000000004C00000-0x0000000004FD0000-memory.dmp

              Filesize

              3.8MB

            • memory/4224-225-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4224-230-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB