laplas | hxxp://ebfertility[.]com

Analysis

max time kernel
24s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ebfertility.com

Score

10^/10

laplas rhadamanthys clipper stealer

Malware Config

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Detect rhadamanthys stealer shellcode 2 IoCs

resource	yara_rule
behavioral1/memory/3844-179-0x0000000001FE0000-0x0000000001FFC000-memory.dmp	family_rhadamanthys
behavioral1/memory/3844-180-0x0000000001FE0000-0x0000000001FFC000-memory.dmp	family_rhadamanthys

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Downloads MZ/PE file

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	94	Go-http-client/1.1

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d42e80ebae45d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe3000000000200000000001066000000010000200000009a9219c2fe8b5667dc67100e1a9ac423b6665f0d7c1f7701158054a0e227c16d000000000e8000000002000020000000662f6e2cc187207091477309b0b6a431d9a845abd8d83fc9c69d05c0db945e0f2000000045d82f95ccdc1268b111d11312f2cac60e98d8f750fe1534fbcddb5b3c176607400000001663993543b9b6b82492f77aff08e518fd7ece8d3075f9bb6ecd95db71232dea9f9a74eb666ecc0ac529b1dc25efe9965bce733682e6dd81205c81da82b7e645	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{A2DBB2D2-BECC-4826-9AAF-DE5A517474FF}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D7972D2E-C796-11ED-9EF6-FA48AF8140A7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401e1da0a35bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1292	iexplore.exe
1292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1292	iexplore.exe
1292	iexplore.exe
3928	IEXPLORE.EXE
3928	IEXPLORE.EXE
3928	IEXPLORE.EXE
3928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3928	1292	iexplore.exe	87
PID 1292 wrote to memory of 3928	1292	iexplore.exe	87
PID 1292 wrote to memory of 3928	1292	iexplore.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://ebfertility.com
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3928
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\clipp.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\clipp.exe"
  2⤵
  PID:2956
- - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
    C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
    3⤵
    PID:4188
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\serv.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\serv.exe"
  2⤵
  PID:3844
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\Arimo-Italic.ttf
  2⤵
  PID:4224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\Arimo-Italic[1].ttf

Filesize
479KB

MD5
545d6555ae115456d26d676111c1a3c2

SHA1
98d780b12f2edd9bfa2f518bcb1f168bb0ce6106

SHA256
5f4917a32312ba8a011502e2147567d678984d820223367a2a4c5d6dda2a758c

SHA512
a185d9d3a217e09006f5f13d2cd74a349b6ad222e87d9c749a7b8dcf9679ec3da75158ffc64786581d63d2781caa03c78c99a7fa8eb1f19c1821230172503040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\clipp[1].exe

Filesize
1.9MB

MD5
8c59b0c004d6d108c494ed8e96f573bb

SHA1
62856aa334190053f0e3b41f7f379a77aaf1cdb1

SHA256
2297b0cced9fde691e8f430d0198f76227b3e617658a6119753d942f9677f589

SHA512
2c966dde8aa92dec51080a02a38c8ed207cd51fc8196bd6a92e3eff316bb6370c90900f3b6c0d5d06e93f34ef925c509cb2c11f3d16a0cd3dc8984f853f85a6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\serv.exe

Filesize
3.2MB

MD5
12c9ffd6da618549ff72192b588354b1

SHA1
b5686190f602449fe4db14da7a31e541d29aad49

SHA256
cc551bcb062e26f7f34be3e568f915b3bcb2927ba89797e55780e0ed99ff8655

SHA512
668ab1e02d1a18d5a94bf350024a7c88f0c7c6e0a64483332663075fbfa605ed1cf99928f982996577e0964d7cec7a1be1ee4b6041a84c10185017a2d0054c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\serv.exe.dt9ela3.partial

Filesize
3.2MB

MD5
12c9ffd6da618549ff72192b588354b1

SHA1
b5686190f602449fe4db14da7a31e541d29aad49

SHA256
cc551bcb062e26f7f34be3e568f915b3bcb2927ba89797e55780e0ed99ff8655

SHA512
668ab1e02d1a18d5a94bf350024a7c88f0c7c6e0a64483332663075fbfa605ed1cf99928f982996577e0964d7cec7a1be1ee4b6041a84c10185017a2d0054c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\serv[1].exe

Filesize
3.2MB

MD5
12c9ffd6da618549ff72192b588354b1

SHA1
b5686190f602449fe4db14da7a31e541d29aad49

SHA256
cc551bcb062e26f7f34be3e568f915b3bcb2927ba89797e55780e0ed99ff8655

SHA512
668ab1e02d1a18d5a94bf350024a7c88f0c7c6e0a64483332663075fbfa605ed1cf99928f982996577e0964d7cec7a1be1ee4b6041a84c10185017a2d0054c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\Arimo-Italic.ttf.fq5irrz.partial

Filesize
479KB

MD5
545d6555ae115456d26d676111c1a3c2

SHA1
98d780b12f2edd9bfa2f518bcb1f168bb0ce6106

SHA256
5f4917a32312ba8a011502e2147567d678984d820223367a2a4c5d6dda2a758c

SHA512
a185d9d3a217e09006f5f13d2cd74a349b6ad222e87d9c749a7b8dcf9679ec3da75158ffc64786581d63d2781caa03c78c99a7fa8eb1f19c1821230172503040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\clipp.exe

Filesize
1.9MB

MD5
8c59b0c004d6d108c494ed8e96f573bb

SHA1
62856aa334190053f0e3b41f7f379a77aaf1cdb1

SHA256
2297b0cced9fde691e8f430d0198f76227b3e617658a6119753d942f9677f589

SHA512
2c966dde8aa92dec51080a02a38c8ed207cd51fc8196bd6a92e3eff316bb6370c90900f3b6c0d5d06e93f34ef925c509cb2c11f3d16a0cd3dc8984f853f85a6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\clipp.exe.lvp9fk4.partial

Filesize
1.9MB

MD5
8c59b0c004d6d108c494ed8e96f573bb

SHA1
62856aa334190053f0e3b41f7f379a77aaf1cdb1

SHA256
2297b0cced9fde691e8f430d0198f76227b3e617658a6119753d942f9677f589

SHA512
2c966dde8aa92dec51080a02a38c8ed207cd51fc8196bd6a92e3eff316bb6370c90900f3b6c0d5d06e93f34ef925c509cb2c11f3d16a0cd3dc8984f853f85a6d

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
161.7MB

MD5
8bde8ae3351aed56435381843a1120c8

SHA1
d92a0e773601c20ea0f0fd442e8c0f06617ece74

SHA256
05157391616f50e1556f75205f4ff85f47a399d18bcee1bbf73829f34ba576fa

SHA512
5341cc7d9de7d7dc851148281608406c30ae1d6947675e15cc1775f33628ff1da715d52dd283e297676f54b8e2202f3525d6e039706e71a4c20ed47a0adb0288

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
151.1MB

MD5
f6fd62b30c77a5b65c1f8d38a87344a7

SHA1
79c907276e90bffadf9e8264282c31b33f93b410

SHA256
b06f501e993e00b7cfc5f896368e3dd3d3d77a906a461a6fce46b9f73fd6778d

SHA512
2d0dbdda6e5dc8d62ee60609c6a3a32a502d612b326cecc75bcc48c3c3015787ec970c0405a8747d6dcbb4fa7caf16bf01c974cb8ef07383464f5fde9105b2fe

Download Submit
memory/2956-162-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2956-158-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2956-145-0x0000000004B50000-0x0000000004F20000-memory.dmp

Filesize
3.8MB

Download
memory/3844-180-0x0000000001FE0000-0x0000000001FFC000-memory.dmp

Filesize
112KB

Download
memory/3844-168-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/3844-179-0x0000000001FE0000-0x0000000001FFC000-memory.dmp

Filesize
112KB

Download
memory/3844-160-0x00000000004F0000-0x000000000051E000-memory.dmp

Filesize
184KB

Download
memory/3844-193-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/3844-194-0x0000000002000000-0x000000000201A000-memory.dmp

Filesize
104KB

Download
memory/3844-195-0x00000000023B0000-0x00000000033B0000-memory.dmp

Filesize
16.0MB

Download
memory/4188-175-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4188-167-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4188-192-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/4188-196-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads