laplas | c6fd140364aeb4b4bed52cd5906bafe85089715d0d4b9c40a462372d9f721be7

General

Target

e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe
Size

1.9MB
MD5

852d500848fe90631597f4c6a195dd37
SHA1

7fd52d47c7ca04b3ce7dbda0c3ff7bf8518f696c
SHA256

e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d
SHA512

14c0ad0c1aa7240cc6509af5cd30b4e28cb6a3619715ea518cdec9018bdfd7d589260ece0f9991dd558069d49551b4c9ca80cfed105396586c3b0f88667a90fb
SSDEEP

49152:vL2WrgyYRhEhqLpAL0GlargNtYafIj/fWC2+Xa0:vHrgyUE+pSlkUo/

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1640	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1580	e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe
1580	e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1640	1580	e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe	27
PID 1580 wrote to memory of 1640	1580	e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe	27
PID 1580 wrote to memory of 1640	1580	e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe	27
PID 1580 wrote to memory of 1640	1580	e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe	27

C:\Users\Admin\AppData\Local\Temp\e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe
"C:\Users\Admin\AppData\Local\Temp\e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
172.4MB

MD5
28ff6cc7275ed212f13a3a2e41aa7139

SHA1
0f8b1aa8181c30f9bdb6cf8e127719317037a7f9

SHA256
0b41ef10bb38ed84bdeaf1f64fb8c5b2ab1bcb8314a98e61c92ca81f2ae2a07b

SHA512
584c77f16e045e628b944164333d7c52782cff2880e2a4e8141dc7faec8ba06e5fd3c1780d73a933301e52d3c35df2a395994c7be39e77b152a29dbac61204d0

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
168.3MB

MD5
4dbf12ed50f7d3658f7e1d39f15c0a29

SHA1
d1d25437e3c7fd2d2febe7e979e0de03d954b8da

SHA256
4383bb4ce0cbb13b8b3b5f8d6a3860fda02ab6e2f99923572698449b1c192389

SHA512
94c718a154a3a3e41360d7b2cc91d5b9629cdc1e8135ba7ca29941e56429db4359030c07ef8715b396e6e81afd82834a92342c43b47ce94373b8f5acf3401325

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
133.3MB

MD5
f720118f786d4fd35f19451ce2c67dda

SHA1
604b7e9d0f8f7a54bba486a114ccd494462c7b60

SHA256
6c353ca3aa01c4eed693bdc20f3781d68d463a7dbd9bfc3764042a6f04486037

SHA512
55d41c56ecea710c2d7387580c196b882448d8245bc97f675c85fcfa3d563ac0cdbd170c2c3efa8eecba78d224bfa69a7137244674d67e864d9ac15d89f6b684

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
144.3MB

MD5
6897954592269a55d6ae965b6a90c472

SHA1
b89067ca1b9bc17b09a58d9baffb62e5441643c5

SHA256
40a77c0fec42e0fbab988c2fde466344925c6760b05b48fa1eea5c9b911b1622

SHA512
1517cd7ed1c2c0f10c9a069a2fde0b8c0336bc9db35e4cd0148d3a8631a75112c10897dbeb2c0dd3df87b6747a87d3cdf59e750d45c6908e5aa01eec5f4e5def

Download Submit
memory/1580-65-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1580-55-0x00000000047F0000-0x0000000004BC0000-memory.dmp

Filesize
3.8MB

Download
memory/1580-54-0x0000000004640000-0x00000000047EA000-memory.dmp

Filesize
1.7MB

Download
memory/1640-68-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-74-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-67-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-64-0x0000000004630000-0x00000000047DA000-memory.dmp

Filesize
1.7MB

Download
memory/1640-69-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-72-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-73-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-66-0x00000000047E0000-0x0000000004BB0000-memory.dmp

Filesize
3.8MB

Download
memory/1640-75-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-76-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-77-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-78-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-79-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download
memory/1640-80-0x0000000000400000-0x0000000002C8F000-memory.dmp

Filesize
40.6MB

Download

Analysis

Sharing