laplas | ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d

General

Target

ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe
Size

291KB
MD5

64c615f1f4f969896b1e0785e39cc311
SHA1

5e0716c1db6c6d0ed40150ee3dc9a11936adca7a
SHA256

ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d
SHA512

eb1ad4079cce413cc3cf984c4cd7cab992101390d7b4f804c746e1a1e4f4f75727465a3c41f3f647a3cdf7f6e7a7e39ce66befefd3ea597b906730cde087c8eb
SSDEEP

3072:sDVYXQLRsDhzybwmNSTAYt7RVreaIy+XFwcr3c5ZLn5t4Wh/:bXQLRFwmcT57vcy8FwcrwjIWh/

Score

10^/10

laplas clipper discovery persistence spyware stealer

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe

Executes dropped EXE 2 IoCs

pid	Process
1260	EGCFHDAKEC.exe
2500	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe
3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	EGCFHDAKEC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4852	3240	WerFault.exe	85

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4976	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	52	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe
3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 3364	3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe	88
PID 3240 wrote to memory of 3364	3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe	88
PID 3240 wrote to memory of 3364	3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe	88
PID 3240 wrote to memory of 1704	3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe	90
PID 3240 wrote to memory of 1704	3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe	90
PID 3240 wrote to memory of 1704	3240	ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe	90
PID 1704 wrote to memory of 4976	1704	cmd.exe	95
PID 1704 wrote to memory of 4976	1704	cmd.exe	95
PID 1704 wrote to memory of 4976	1704	cmd.exe	95
PID 3364 wrote to memory of 1260	3364	cmd.exe	96
PID 3364 wrote to memory of 1260	3364	cmd.exe	96
PID 3364 wrote to memory of 1260	3364	cmd.exe	96
PID 1260 wrote to memory of 2500	1260	EGCFHDAKEC.exe	102
PID 1260 wrote to memory of 2500	1260	EGCFHDAKEC.exe	102
PID 1260 wrote to memory of 2500	1260	EGCFHDAKEC.exe	102

C:\Users\Admin\AppData\Local\Temp\ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe
"C:\Users\Admin\AppData\Local\Temp\ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EGCFHDAKEC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Local\Temp\EGCFHDAKEC.exe
    "C:\Users\Admin\AppData\Local\Temp\EGCFHDAKEC.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:2500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ad12983641a6deb84c9c86d5fa24eb5380db39c010e15c004ecf4837440a8a7d.exe" & del "C:\ProgramData\*.dll"" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 2240
  2⤵
  - Program crash
  PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3240 -ip 3240
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\EGCFHDAKEC.exe

Filesize
1.9MB

MD5
a3d960222dfdb92fe84e8b9d257da4db

SHA1
90737e7847d878071d8f9ec630f611636af12c53

SHA256
cc1abecc9c66a7c591b1b4feacfbcc4f46ded09ba2141845cdb860108f0e1876

SHA512
954b7c8e39e47a3c2431e57c2e7c4c2da305f7d302c8b098cfa6784840553aa4113fc417e40ca72adc16df74c2549761297a74c44bcbf51c5cc9ead28536b609

Download Submit
C:\Users\Admin\AppData\Local\Temp\EGCFHDAKEC.exe

Filesize
1.9MB

MD5
a3d960222dfdb92fe84e8b9d257da4db

SHA1
90737e7847d878071d8f9ec630f611636af12c53

SHA256
cc1abecc9c66a7c591b1b4feacfbcc4f46ded09ba2141845cdb860108f0e1876

SHA512
954b7c8e39e47a3c2431e57c2e7c4c2da305f7d302c8b098cfa6784840553aa4113fc417e40ca72adc16df74c2549761297a74c44bcbf51c5cc9ead28536b609

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
456.4MB

MD5
01a57cf3e00a71a2c645ec9ae4e16d5a

SHA1
cbe5401969f6d410f21283cc302feebc95bf30e9

SHA256
dd4d2c7d71d93228cb675419f410c3fdc03f1aabac391bb9a9146c39e99a80f7

SHA512
8f156154a14c6c416919e3648cff6ff2fe1795080194a94aa1acbfdfcc877d0921d065d4e1721bcc7f1b818a589c9a7b07f1132f22cb22e32a4eae9dda6227b1

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
417.6MB

MD5
bb747ce67337a3896cbcfe20ce7cb8c3

SHA1
e4f84a6536b26e2b85de0f58afee921d6fc63d4f

SHA256
4f15b7147063a0733d17f48cd35a76bf523d1372e9a743484c3b0c3c5e29b6c8

SHA512
b4ca634a8e218e152859dedb9616ea0a3b91332e25b513ebca6ef354385c8b1af60f02b4dc220b87dad157c4df6e7b6cbd527e2853a731b7324b167a9bd81ac9

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
431.5MB

MD5
b0d6e0d30107bda3b5aff19af1c6138e

SHA1
593ef53be0b989c7820832a6d79d23bdb15bd2ed

SHA256
6aebdc1e257e39088dc795f7fb0a03d266839c2ef2acfeaa48e601b10b02618b

SHA512
d9209f59a24bd88e13785915463d0780d7a898d444542d06322b229f8354174dfda143e66ec6e62fbf98a7b468ce947aaca3b5ce011cdd84632a01cfb3a40d77

Download Submit
memory/1260-215-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/1260-212-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/1260-209-0x0000000004C00000-0x0000000004FD0000-memory.dmp

Filesize
3.8MB

Download
memory/2500-225-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-223-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-232-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-219-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-220-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-221-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-222-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-231-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-224-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-230-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-227-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-228-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2500-229-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/3240-210-0x0000000000400000-0x0000000002AF9000-memory.dmp

Filesize
39.0MB

Download
memory/3240-134-0x0000000004850000-0x0000000004865000-memory.dmp

Filesize
84KB

Download
memory/3240-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads