Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2023, 00:20

General

  • Target

    4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe

  • Size

    296KB

  • MD5

    8aefc7b3b4751823e45fe75991b64140

  • SHA1

    e907b0f887e7af95a2d0b15ade8823fcf55cdd43

  • SHA256

    4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047

  • SHA512

    e7defbe71c9faeaf2dbf45fcc375c9c99f6df604797a0ab80a9c59d1ecd812568594a903aa7bf0c8c43f87009000b68d6c7cf49d5e2e5219df7af55cc17b5228

  • SSDEEP

    3072:O052gg8LefGClpWze8q04Ng9dbn3G+AXjg3/2ZRzxEKjdqsjc6ZztqgmAu:Oag8LeOClpWUg9dy+iW2dEYqaxu

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe
    "C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe
        "C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
          4⤵
          • Executes dropped EXE
          PID:4424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 492
          4⤵
          • Program crash
          PID:4772
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:4100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 2056
      2⤵
      • Program crash
      PID:3108
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1528 -ip 1528
    1⤵
      PID:848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3580 -ip 3580
      1⤵
        PID:2320

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • C:\ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • C:\ProgramData\nss3.dll

              Filesize

              2.0MB

              MD5

              1cc453cdf74f31e4d913ff9c10acdde2

              SHA1

              6e85eae544d6e965f15fa5c39700fa7202f3aafe

              SHA256

              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

              SHA512

              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            • C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe

              Filesize

              1.9MB

              MD5

              1874484481b8ba2de4b6da79f1500a7e

              SHA1

              03b757f78281f3059a47ef9ef5a4d44f00183bc9

              SHA256

              0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0

              SHA512

              ef65dbba565d50024df21fcbb78d56890927327fb18e2f55d9d8023d7d79987a15fc261e7c004b921ed434b8bafa97f3ff53fcca7063c944778b694ff19a6b84

            • C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe

              Filesize

              1.9MB

              MD5

              1874484481b8ba2de4b6da79f1500a7e

              SHA1

              03b757f78281f3059a47ef9ef5a4d44f00183bc9

              SHA256

              0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0

              SHA512

              ef65dbba565d50024df21fcbb78d56890927327fb18e2f55d9d8023d7d79987a15fc261e7c004b921ed434b8bafa97f3ff53fcca7063c944778b694ff19a6b84

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              560.2MB

              MD5

              f3639047f0e23e2591c044c0559b2917

              SHA1

              2dd21157e554c35cfe179b111d0350b6d5aea15c

              SHA256

              9b776011f1a5622b7bfa7b2326bbc5f5026c72abcf74fed87d601630aaedc3ea

              SHA512

              92699f40533ddebd97bbc78b4ef950bafe5c57fb38c9035d5f990800235307bfaade137ff0564223d65480818e6a05a3105698d3806a93e30e5162d4139d288f

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              666.4MB

              MD5

              4f593195eeb491901c1140fcb7577a49

              SHA1

              bfd0351d93e896bb10f5c0c5ba38dc948ace3ab4

              SHA256

              dd7d6f465996a7c77454bdff48588dd87354aadfad1631fcb731e9fb46ff2358

              SHA512

              0b646242608e7eb3869690edd642555178223aececda53a06d5e6ff3eb8461bcde9f41b40e847b4a00b107a4f7457e36694653cc49d0dcb5b483be85e3802bbb

            • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

              Filesize

              524.1MB

              MD5

              c402a9c9791550b82abdda5b0c59ed69

              SHA1

              4e36776ccf1d75bded894c4b7ce2e7fbf3f8c1ef

              SHA256

              aa9b75bb8177b2dc9d1c59d73ecd717a7e157aa4eb57b674ebe147b911ba0782

              SHA512

              fa83f39bf6994dce28cd655e01b30b852afa5b92596ac4e83f32ab25ce09950c508b42140f656440535cb73b9f9c633fb39b3fd316b9837fea23f615dc503633

            • memory/1528-206-0x0000000000400000-0x0000000002AFB000-memory.dmp

              Filesize

              39.0MB

            • memory/1528-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

              Filesize

              972KB

            • memory/1528-134-0x00000000046F0000-0x0000000004705000-memory.dmp

              Filesize

              84KB

            • memory/3580-208-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/3580-205-0x0000000004C20000-0x0000000004FF0000-memory.dmp

              Filesize

              3.8MB

            • memory/3580-213-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-216-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-215-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-214-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-218-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-219-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-220-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-221-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-222-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-223-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-224-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-225-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB

            • memory/4424-226-0x0000000000400000-0x0000000002C8F000-memory.dmp

              Filesize

              40.6MB