laplas | 9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2023 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98.exe
Size

1.9MB
MD5

ad71a24d622cbb5f8335ead026d1bdfc
SHA1

f95ddc723a16ed62fc670069a2e33e358ff68faf
SHA256

9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98
SHA512

c5fe10a019dabe6cac7e2b50c3e5e2616a66a35c46d7aad600f501a1afa71020e53527c13a3e1bdf0606d362a4c13ed36cda44b2cd8be06cc330d4fa4fca47f1
SSDEEP

49152:KQMNpBLv05kosHTzRIMvQyxmNTD/dscF96zpP6rF/c:KNNLvGkJTywxmIpzcry

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
4064	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	928	WerFault.exe	84

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	20	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4064	928	9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98.exe	88
PID 928 wrote to memory of 4064	928	9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98.exe	88
PID 928 wrote to memory of 4064	928	9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98.exe	88

C:\Users\Admin\AppData\Local\Temp\9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98.exe
"C:\Users\Admin\AppData\Local\Temp\9178d0152c7511a2f09a96a647508c211ad860780a50a753ed4c22c0fd71ec98.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 492
  2⤵
  - Program crash
  PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 928 -ip 928
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
795.8MB

MD5
77e18c31ed609a688cef41c9bc7bf069

SHA1
cd1c0b985bb1f71ee641184561dac189b1c87811

SHA256
21f4e6febe0326b3b1be9cb42d3a9ac3054a42dae2ceb8c7b0920d9bfe33340d

SHA512
523043a50939b5affaa4bb20c9583fde37fd1b92c824954b73744be3aa653756faa9d65d85edc8aa1bac6376141146b49e5a368122ad25d44fa8e6dfee21e4d5

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
840.9MB

MD5
d77e125819212c9ce80c7f3bf0ae3747

SHA1
9a2623a6886a2cb8f8a18c4b73293967ef91b7b0

SHA256
6212bf5f09a198659e6aa556b4246c64a4fd2c17600bb15553360e3809fc22c4

SHA512
d7ed6dc57aa7c4f4d0bc9b657aef0548ac5c96b491ecd8a823fce04eb9f5e89227dcda44520bf1862a014cd84ad51523022ecda472d2a19f7f7d1ed82ff5e573

Download Submit
memory/928-134-0x0000000004BC0000-0x0000000004F90000-memory.dmp

Filesize
3.8MB

Download
memory/928-136-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/928-141-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-146-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-150-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-144-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-142-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-147-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-148-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-149-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-143-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-151-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-152-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-153-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-154-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-155-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4064-156-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download