laplas | 6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d

General

Target

6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe
Size

301KB
MD5

728b0179ac21c2451c921a70e81a1fe0
SHA1

128295fa736be0e0102030a6258f7b2f39748b97
SHA256

6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d
SHA512

cfe7f5e893e94e2a388b6bc4132563998e6ee891edf68301b6c6e7a8b23623237df0bf14ec5f3ea8112c0ff9a5f7405ddcd4fac993e0cb11d1ecf93d87e6a498
SSDEEP

3072:YqH7w7LJPW6wYG6QbUn/pmU2b/5MCY3BUwKxqVPksTX581tAzo1L:Jw7LJO6g6n2L/iuxKPJCMzo1L

Score

10^/10

laplas clipper discovery persistence spyware stealer

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe

Executes dropped EXE 2 IoCs

pid	Process
3460	DHDAFBFCFH.exe
4480	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe
4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	DHDAFBFCFH.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5000	4520	WerFault.exe	85

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4172	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	43	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe
4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 1280	4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe	88
PID 4520 wrote to memory of 1280	4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe	88
PID 4520 wrote to memory of 1280	4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe	88
PID 4520 wrote to memory of 4140	4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe	90
PID 4520 wrote to memory of 4140	4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe	90
PID 4520 wrote to memory of 4140	4520	6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe	90
PID 4140 wrote to memory of 4172	4140	cmd.exe	93
PID 4140 wrote to memory of 4172	4140	cmd.exe	93
PID 4140 wrote to memory of 4172	4140	cmd.exe	93
PID 1280 wrote to memory of 3460	1280	cmd.exe	94
PID 1280 wrote to memory of 3460	1280	cmd.exe	94
PID 1280 wrote to memory of 3460	1280	cmd.exe	94
PID 3460 wrote to memory of 4480	3460	DHDAFBFCFH.exe	100
PID 3460 wrote to memory of 4480	3460	DHDAFBFCFH.exe	100
PID 3460 wrote to memory of 4480	3460	DHDAFBFCFH.exe	100

C:\Users\Admin\AppData\Local\Temp\6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe
"C:\Users\Admin\AppData\Local\Temp\6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DHDAFBFCFH.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\DHDAFBFCFH.exe
    "C:\Users\Admin\AppData\Local\Temp\DHDAFBFCFH.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:4480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6904f4ff6103ed7a2eb958c5cde96bec685b853ca44814cd7b7fcea00c396b7d.exe" & del "C:\ProgramData\*.dll"" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 2344
  2⤵
  - Program crash
  PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4520 -ip 4520
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\DHDAFBFCFH.exe

Filesize
1.9MB

MD5
767304da223d94dd67714d4089f354ad

SHA1
cab06ce07cfd4aa406f02fb867b9dc00f6b0fbb9

SHA256
539d9bfc0eb0a2d7b2d638926731f424e890c7b7c2a9c4410b5fe378a992e0d5

SHA512
d1cb342c29b3c0a16c284f9453d43835efedeadcc276e83566a178fef2f67e01cb3e0ee7dbcf381b51a76f646c080b2ed63ab06f85a818fb9d11b2abc33e33b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DHDAFBFCFH.exe

Filesize
1.9MB

MD5
767304da223d94dd67714d4089f354ad

SHA1
cab06ce07cfd4aa406f02fb867b9dc00f6b0fbb9

SHA256
539d9bfc0eb0a2d7b2d638926731f424e890c7b7c2a9c4410b5fe378a992e0d5

SHA512
d1cb342c29b3c0a16c284f9453d43835efedeadcc276e83566a178fef2f67e01cb3e0ee7dbcf381b51a76f646c080b2ed63ab06f85a818fb9d11b2abc33e33b9

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
512.6MB

MD5
9c2e04ed8d3d64eeb919c6f09fd42ed1

SHA1
2fe5799b53ac7cbbeb7e7362e6d8c02a150aacee

SHA256
63f4f5c96b2d919daf586bc14bf9376b6eaba0dab48b6cceb0ed861b240a3c97

SHA512
8ac340523214869211991b5ad1bae7a9ac17743d9b938fa00c3f5b704c3c11d283ccf026be4151f28a52a353cdfad1cbc69fea18da51e720052d3091762a2a0b

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
491.8MB

MD5
e399ef4adffb49ba05bd61baf43871ee

SHA1
a87c4b52762c0ce9afce81a01e528e7117c402c3

SHA256
e7cab2e614c3f3169aa21955ec94a50cf8e15a29e7f8775e0192d268f30fff33

SHA512
b40892f7770776eb3238efd508c5c3e47b70bb9ecb13574c2270a776be25fc6111ec903db2c1f2903825765182271aba000c35bbb5670ef275a556ef2a292323

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
475.4MB

MD5
20c5e561027fb7fbe9fea4a040e613f5

SHA1
07ee7b12e1353cfad804766784bb2a4ae5d2cd11

SHA256
a6c9494aa25cab51f053dd33a4e3ddb5dcdd154aefcf77420e8007edc5fe7221

SHA512
3cd3b9e038d0d17dd3e1d11e9d55de0c04d23de369861ffae751abd717adeaa1d71788065ec24687123f21a05eed9140b1ab6ef902ff7c031ac847f3d62dff2e

Download Submit
memory/3460-210-0x0000000004C50000-0x0000000005020000-memory.dmp

Filesize
3.8MB

Download
memory/3460-213-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/3460-217-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-228-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-224-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-232-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-219-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-220-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-221-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-223-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-231-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-225-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-226-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-227-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-230-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4480-229-0x0000000000400000-0x0000000002C90000-memory.dmp

Filesize
40.6MB

Download
memory/4520-211-0x0000000000400000-0x0000000002AFB000-memory.dmp

Filesize
39.0MB

Download
memory/4520-134-0x0000000002C90000-0x0000000002CA5000-memory.dmp

Filesize
84KB

Download
memory/4520-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads