laplas | 159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2023 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696.exe
Size

1.9MB
MD5

e318cdda3c407337ea8b36782f1708ac
SHA1

fe61548bde839be77777ff6ddf476710c2c576da
SHA256

159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696
SHA512

11cd1aff62deb355c9085954fc388a8f6924e0e1da8f7354201e5da1858668aec7daeca805cca5af73160828e3a7acd32137c5211422ab4914a40417a3e76753
SSDEEP

49152:jkHdHdC75YBlCqm4/kdJjAWfdhSI+dW9ZltP4PdSsG0C:jkHd9S5mCqFk7fdx+duPP4Pss1

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2140	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	21	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2140	3036	159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696.exe	89
PID 3036 wrote to memory of 2140	3036	159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696.exe	89
PID 3036 wrote to memory of 2140	3036	159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696.exe	89

C:\Users\Admin\AppData\Local\Temp\159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696.exe
"C:\Users\Admin\AppData\Local\Temp\159064b0b1e732079092f0fe367c3eca8ec8b359fb427868b28c65878b4de696.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
828.9MB

MD5
514fc01ed45aec815cb2f6ddc50f5fba

SHA1
10bc7b3d5789b0418ac18e6abdb5964faa807f52

SHA256
efb870a2de5c849cfb76cac3fe291757a15929d8751d5e62e422a452853f40fc

SHA512
f798d60cd5be2835cf9daf3ee9bba1391aecfbe432d2f39bba30b81ce00583b23ce9e756535dc919590c49c54e97d682060a88b99302a77d89c97bd1d3bc8db4

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
828.9MB

MD5
514fc01ed45aec815cb2f6ddc50f5fba

SHA1
10bc7b3d5789b0418ac18e6abdb5964faa807f52

SHA256
efb870a2de5c849cfb76cac3fe291757a15929d8751d5e62e422a452853f40fc

SHA512
f798d60cd5be2835cf9daf3ee9bba1391aecfbe432d2f39bba30b81ce00583b23ce9e756535dc919590c49c54e97d682060a88b99302a77d89c97bd1d3bc8db4

Download Submit
memory/2140-158-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-155-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-169-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-142-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-144-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-148-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-149-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-151-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-153-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-167-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-165-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-159-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-161-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2140-163-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/3036-134-0x0000000004D90000-0x0000000005160000-memory.dmp

Filesize
3.8MB

Download
memory/3036-138-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/3036-141-0x0000000004D90000-0x0000000005160000-memory.dmp

Filesize
3.8MB

Download