laplas | de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c

General

Target

de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe
Size

292KB
MD5

535d5d92cf3c0db884ac78912483fc40
SHA1

b31d037c28f06d14734c7424efd9e44eaa423247
SHA256

de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c
SHA512

0eb314b2fce4e27d62dea19d34bb378dae200743437caf04d932fba9f01fb9cafe5fcb1eb38713268ac7254598c3907e8ee5ec8fffdef7b40240e6526d3b4a04
SSDEEP

3072:GqD8gX1LTDhnY3C2/TGuBujshl5BwFRx89KwPf5RLn4tuhiPE:GWX1LTVnY3pOe3BWRq9KwP3jME

Score

10^/10

laplas clipper discovery persistence spyware stealer

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1588	KJDHCAFCGD.exe
4744	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe
2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	KJDHCAFCGD.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2876	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe
2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3924	2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe	66
PID 2468 wrote to memory of 3924	2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe	66
PID 2468 wrote to memory of 3924	2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe	66
PID 2468 wrote to memory of 4608	2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe	67
PID 2468 wrote to memory of 4608	2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe	67
PID 2468 wrote to memory of 4608	2468	de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe	67
PID 4608 wrote to memory of 2876	4608	cmd.exe	70
PID 4608 wrote to memory of 2876	4608	cmd.exe	70
PID 4608 wrote to memory of 2876	4608	cmd.exe	70
PID 3924 wrote to memory of 1588	3924	cmd.exe	71
PID 3924 wrote to memory of 1588	3924	cmd.exe	71
PID 3924 wrote to memory of 1588	3924	cmd.exe	71
PID 1588 wrote to memory of 4744	1588	KJDHCAFCGD.exe	72
PID 1588 wrote to memory of 4744	1588	KJDHCAFCGD.exe	72
PID 1588 wrote to memory of 4744	1588	KJDHCAFCGD.exe	72

C:\Users\Admin\AppData\Local\Temp\de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe
"C:\Users\Admin\AppData\Local\Temp\de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KJDHCAFCGD.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Users\Admin\AppData\Local\Temp\KJDHCAFCGD.exe
    "C:\Users\Admin\AppData\Local\Temp\KJDHCAFCGD.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:4744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\de565992035f04954144853c6ea32bcb011becb55422c243bdeaaa65bb69c68c.exe" & del "C:\ProgramData\*.dll"" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\Local\Temp\KJDHCAFCGD.exe

Filesize
1.9MB

MD5
d82d5fafc8c0f6101377aadd1dd8e876

SHA1
c904ed33def78b0fe785190898b6378afdccaff0

SHA256
053036a7cd26440014339b3f1bc5daf8b3cd83df57c73eac552df3ca2f78eaff

SHA512
347e76f0723dea228c58b3a13a90be669ebaed96bc566a79763f4824d88cb3d9ae1233ffff5c6d9e226b2a1be21383c84b8437970d9cfca85d571d24cc894a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\KJDHCAFCGD.exe

Filesize
1.9MB

MD5
d82d5fafc8c0f6101377aadd1dd8e876

SHA1
c904ed33def78b0fe785190898b6378afdccaff0

SHA256
053036a7cd26440014339b3f1bc5daf8b3cd83df57c73eac552df3ca2f78eaff

SHA512
347e76f0723dea228c58b3a13a90be669ebaed96bc566a79763f4824d88cb3d9ae1233ffff5c6d9e226b2a1be21383c84b8437970d9cfca85d571d24cc894a30

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
461.6MB

MD5
65f874c854e9657c7d6b66b96881564c

SHA1
aa1191b88e710f5a16732ab9e79b38eb52ad68c2

SHA256
c400981e4eedeaf52d5bf345fa52d0c09bf0e2fb47b1df6cd0b4d85b4cc1d8b3

SHA512
4d9868bca67703abc53ebcc278ca0442f7bef28338690156c52185d43991c4b0ec384b542a2aab50c7be6dc2bca8cbd29b6e9908da4db93a971eff1f70094fa5

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
467.6MB

MD5
ff992b147a46843ab097cd1d0ea12a7d

SHA1
54c56671706607d7613f5d55adb9688438cb9d84

SHA256
73862b0688826239921f3b6236d6c47479cc2a63770e98942add7285b443897f

SHA512
a9d6bb73b5e656a34884e8d32a8fb250c99ffe7bfabfb61a34f137cb08789e3aafe4b0f6842d99d1022ffaefeb68b27f8d56ac82f63cce3d014a2b030dc00aa6

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
430.7MB

MD5
8a50bcc40e438634532780029844cad6

SHA1
357cda04d06d34457ecba236c5c9b3525a0051a3

SHA256
9bde87cc830cb958aaa322cb4fbc9289180bc40a8fc31b2c0255d08ed3c79637

SHA512
ae8bbed1c91382f9e6523b455bd08ee2ac70a9a6018184b5c6e84ec0025ef72142507d1630e8d9b3a7186f02b3a7f6dc2e44c3704fdcbf4f9ef997d729ecfbb7

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/1588-198-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/1588-192-0x0000000004BC0000-0x0000000004F90000-memory.dmp

Filesize
3.8MB

Download
memory/2468-187-0x0000000000400000-0x0000000002AF9000-memory.dmp

Filesize
39.0MB

Download
memory/2468-123-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2468-122-0x0000000002C70000-0x0000000002C85000-memory.dmp

Filesize
84KB

Download
memory/4744-204-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-200-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-201-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-203-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-199-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-205-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-206-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-207-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-208-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-209-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-210-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-211-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/4744-212-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download

Analysis

Sharing