Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2023, 00:20

General

  • Target

    0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0.exe

  • Size

    1.9MB

  • MD5

    1874484481b8ba2de4b6da79f1500a7e

  • SHA1

    03b757f78281f3059a47ef9ef5a4d44f00183bc9

  • SHA256

    0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0

  • SHA512

    ef65dbba565d50024df21fcbb78d56890927327fb18e2f55d9d8023d7d79987a15fc261e7c004b921ed434b8bafa97f3ff53fcca7063c944778b694ff19a6b84

  • SSDEEP

    49152:cHMBJG6TvmoAXn8CNSOTFIirSsyOTJpNnEw/UY3GJw9l:kWT1AzNSFirSOJpNnd/Dl

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0.exe
    "C:\Users\Admin\AppData\Local\Temp\0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Executes dropped EXE
      PID:824

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

          Filesize

          723.9MB

          MD5

          5e0f5616addf312bcf4edecc72d53f8f

          SHA1

          7ecec51b5ff6f3cfebbd72d95bf361ce25523db0

          SHA256

          9697ceaef72f2a6cc221364a8111b7006a5f9551f59ef3e04258da106b3bc67f

          SHA512

          6abd5aa721701bd1596b35ce59797a3f34654cfa33799a9681322b0048b2ad1ce07f388cbfdcb640c11af6a4512c6ebe37c248cbaa51878fc784440a953f424e

        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

          Filesize

          723.9MB

          MD5

          5e0f5616addf312bcf4edecc72d53f8f

          SHA1

          7ecec51b5ff6f3cfebbd72d95bf361ce25523db0

          SHA256

          9697ceaef72f2a6cc221364a8111b7006a5f9551f59ef3e04258da106b3bc67f

          SHA512

          6abd5aa721701bd1596b35ce59797a3f34654cfa33799a9681322b0048b2ad1ce07f388cbfdcb640c11af6a4512c6ebe37c248cbaa51878fc784440a953f424e

        • memory/824-153-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-149-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-157-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-156-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-143-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-144-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-145-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-147-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-148-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-155-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-150-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-151-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-152-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/824-154-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/3852-134-0x0000000004CE0000-0x00000000050B0000-memory.dmp

          Filesize

          3.8MB

        • memory/3852-137-0x0000000004CE0000-0x00000000050B0000-memory.dmp

          Filesize

          3.8MB

        • memory/3852-142-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB

        • memory/3852-136-0x0000000000400000-0x0000000002C8F000-memory.dmp

          Filesize

          40.6MB