Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2023, 00:51

General

  • Target

    00d3cd08ccbd51f7e9c5c186c101494281413e0d5f6afea753e025aa6eac388e.exe

  • Size

    1.9MB

  • MD5

    b5ddb8ef8e4c2d6794ea20684387c71e

  • SHA1

    845c7315887330fe61714dcdbea413dd6ba5a049

  • SHA256

    00d3cd08ccbd51f7e9c5c186c101494281413e0d5f6afea753e025aa6eac388e

  • SHA512

    c3cfdb5ade38bbd074671cb889a59cedcd35d6b85866e917fb4e7bfe659d6ec2126c14bef31b1099464ae5ba4644e21599172a9c2d3da921808b066e11cf846c

  • SSDEEP

    49152:M7AIvTPPfHKV78/xtsbInXSv4iYsoM4As2vGriv:MjHCV78/xtsbIixxTs3Ov

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00d3cd08ccbd51f7e9c5c186c101494281413e0d5f6afea753e025aa6eac388e.exe
    "C:\Users\Admin\AppData\Local\Temp\00d3cd08ccbd51f7e9c5c186c101494281413e0d5f6afea753e025aa6eac388e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Executes dropped EXE
      PID:3412
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 464
      2⤵
      • Program crash
      PID:1372
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4964 -ip 4964
    1⤵
      PID:1080

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

            Filesize

            770.9MB

            MD5

            cf7c6e94f690af20b56b6346948c2f38

            SHA1

            f6f61f375c9c9857311f641d5c06feac1fa117fe

            SHA256

            0c46c87d3a107c5f3b98f3a48aaaa1e27636240223e1dfc51f6e2d11092d9189

            SHA512

            8d3b4f2129e8986e5ff0bb7df35fa3ac55931a695ddf0a9fcd482dba35f75182909d7060242edf638829104cdbb1587022e921a8c28a0429ae5c4c5b3c58d2a5

          • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

            Filesize

            770.9MB

            MD5

            cf7c6e94f690af20b56b6346948c2f38

            SHA1

            f6f61f375c9c9857311f641d5c06feac1fa117fe

            SHA256

            0c46c87d3a107c5f3b98f3a48aaaa1e27636240223e1dfc51f6e2d11092d9189

            SHA512

            8d3b4f2129e8986e5ff0bb7df35fa3ac55931a695ddf0a9fcd482dba35f75182909d7060242edf638829104cdbb1587022e921a8c28a0429ae5c4c5b3c58d2a5

          • memory/3412-150-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-149-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-156-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-142-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-143-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-144-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-146-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-147-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-148-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-155-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-154-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-151-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-152-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/3412-153-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/4964-134-0x0000000004DC0000-0x0000000005190000-memory.dmp

            Filesize

            3.8MB

          • memory/4964-136-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB

          • memory/4964-141-0x0000000000400000-0x0000000002C8F000-memory.dmp

            Filesize

            40.6MB