laplas | 6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b

General

Target

6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
Size

332KB
MD5

3b9a24b8d96add6e30999d01707caffd
SHA1

8c2987facc8425d0208227aa53cec0bdd056e083
SHA256

6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b
SHA512

f2a69b1f9818c1336756e8ef63f236b1308735f7b98e97165335b190ef2dd729c0193d150bc8d1c07c6b7742e8f562267b9b7f36eb06319ed1c306582d9aad8f
SSDEEP

6144:GqGW13LMNttroHH9GAowS4btkDt8Yfd/E:J13gNttryHIAowS4Zk5zfd/

Score

10^/10

laplas clipper discovery persistence spyware stealer

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe

Executes dropped EXE 2 IoCs

pid	Process
2784	HJJJECFIEC.exe
2996	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	HJJJECFIEC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	1516	WerFault.exe	83

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4260	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	42	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4412	1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe	87
PID 1516 wrote to memory of 4412	1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe	87
PID 1516 wrote to memory of 4412	1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe	87
PID 1516 wrote to memory of 5076	1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe	89
PID 1516 wrote to memory of 5076	1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe	89
PID 1516 wrote to memory of 5076	1516	6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe	89
PID 4412 wrote to memory of 2784	4412	cmd.exe	92
PID 4412 wrote to memory of 2784	4412	cmd.exe	92
PID 4412 wrote to memory of 2784	4412	cmd.exe	92
PID 5076 wrote to memory of 4260	5076	cmd.exe	93
PID 5076 wrote to memory of 4260	5076	cmd.exe	93
PID 5076 wrote to memory of 4260	5076	cmd.exe	93
PID 2784 wrote to memory of 2996	2784	HJJJECFIEC.exe	98
PID 2784 wrote to memory of 2996	2784	HJJJECFIEC.exe	98
PID 2784 wrote to memory of 2996	2784	HJJJECFIEC.exe	98

C:\Users\Admin\AppData\Local\Temp\6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe
"C:\Users\Admin\AppData\Local\Temp\6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe
    "C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6e53cd4ff1c9a249cfb8f15e0ace2d7139843b14726ef12cc26bf9b469f59c4b.exe" & del "C:\ProgramData\*.dll"" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1936
  2⤵
  - Program crash
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1516 -ip 1516
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe

Filesize
1.9MB

MD5
78d8d347bab1cea911f9c841654acef0

SHA1
81597af51260f0e810095374b3a997952dd67101

SHA256
7c849ca7534ee84e5e769f3f84f6af78121bc4e45b9888d1fdbfedd338b7e606

SHA512
77db0a76049cd38999753b7b7d0fb22ab6d5d5ae6727c2385526e2da5bdd7617e5a67f2e5419a06622a8e674ef810fa7cfe3d1bdefbb8a79253d890b07d39230

Download Submit
C:\Users\Admin\AppData\Local\Temp\HJJJECFIEC.exe

Filesize
1.9MB

MD5
78d8d347bab1cea911f9c841654acef0

SHA1
81597af51260f0e810095374b3a997952dd67101

SHA256
7c849ca7534ee84e5e769f3f84f6af78121bc4e45b9888d1fdbfedd338b7e606

SHA512
77db0a76049cd38999753b7b7d0fb22ab6d5d5ae6727c2385526e2da5bdd7617e5a67f2e5419a06622a8e674ef810fa7cfe3d1bdefbb8a79253d890b07d39230

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
501.7MB

MD5
1f5b76d6309d7dcb503cf23043498834

SHA1
4b845c8ccdf97b4ae69c6435b16c249098517392

SHA256
0604f8a5f0da1d111cfcb689aca75ef4db2e19582e11992d164fd6c626cd2b05

SHA512
0ee6d7c73eab704fa1bafd8f3bf79501cb8ac9f40acac687e4c03f0bb1813badec07719b992a083fdbb22843b0380cf59895f1adcad44e4ae69bb0df32b7e9d9

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
511.0MB

MD5
7743b818139a5438b8546aca119fa83d

SHA1
c00150569fdf70f45452becdc45baa0dc78dde45

SHA256
8f9cf2561f3e5060e536f5387c32ec3523a17a1811d96f6995d3e5ddbbff793f

SHA512
7ba1980352ee091293b9289d24b55c7fc3ca198a7e9503f169faa6b7ef9dcd74f7614891106dac13a8240d67d125a98b8a166b30565bc12314dbb4bd24550eda

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
467.8MB

MD5
42d49a9edb48e9ba896e81105d87fb2a

SHA1
0b349d5f08bb24eb4100426ba041adeac9ab2930

SHA256
17d4a280ed006c618c296fc49047dac9300e44cca110dc5d83cb3ca848d0172c

SHA512
542546c2208a1ba854141fb7d7421e2e6720b4d354642500161b771de99144cfa370de5d5809c2de76f072125f2dc8ced691dc3c58a9ee95e977f43239162bd3

Download Submit
memory/1516-215-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/1516-134-0x0000000004850000-0x0000000004865000-memory.dmp

Filesize
84KB

Download
memory/1516-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2784-214-0x0000000004BD0000-0x0000000004FA0000-memory.dmp

Filesize
3.8MB

Download
memory/2784-216-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2784-218-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2784-222-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-227-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-226-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-225-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-228-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-230-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-231-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-232-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-233-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-234-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-235-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-236-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download
memory/2996-237-0x0000000000400000-0x0000000002C98000-memory.dmp

Filesize
40.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads