laplas | 0b5a11c6d54197c5d8416fe31269f1d4448dd7935adf53725ca31f07c98bbbe4

General

Target

b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe
Size

1.9MB
MD5

7e1ee04719bea1b532ed44609632ccd9
SHA1

f6ad1ded616f8877cb34f873b3597aa6df50e957
SHA256

b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc
SHA512

0bbb7c9e68f27d05476a301ec95b0a3ee7ab46ab3e912adcb14bbe44015b07ef1668e076518076abf79c6b366a1d59f057553411383a263ab539786853bc2819
SSDEEP

24576:prRWZ35JhqWpgXEC9CsacGA2XqHO4fOD22eAbFKhvb12pG5UojUsw1EyYMoPBETh:prsvJhS7Rj26H/fOyj1qG5UojUslMoJ

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
844	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
364	b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe
364	b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 844	364	b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe	28
PID 364 wrote to memory of 844	364	b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe	28
PID 364 wrote to memory of 844	364	b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe	28
PID 364 wrote to memory of 844	364	b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe	28

C:\Users\Admin\AppData\Local\Temp\b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe
"C:\Users\Admin\AppData\Local\Temp\b46481ba0ba92b4cf9306181a82bff5cd1f1213fd23fb73c01a5b46435c7bebc.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
41.6MB

MD5
563d8f61ffb6e9105d8478c1765f597d

SHA1
fbf2b05c75c5d0ac4c5dd851f6ef8dadb6d12e25

SHA256
abb4adf2e67765a28c7d1d08dcc24f202dda1c6790c97ff4d7fede5651a60f9c

SHA512
ba09cccaaf79f21f93bbf8e2c66be33148ce51c6a389a179cfc4e49383bf4f17741ba0eb6bd2fd8978033e4f8730787dd0c8169ec8839e3cd121ee2528250d5d

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
41.9MB

MD5
645ec8ee059bf85483a2ac85638b2c15

SHA1
8d7ccc10fd50075f225b769c15e39712e0435696

SHA256
d07504d2ad579bc8eef517b23ae76707bf149878644cd0991c033f9c03ea2b10

SHA512
0423179649d8bcc09d88feeac1ba45fac75b2d1f1660e92e316937d335e57004357e6b8407a16c7c76c4e6f9b3f95ba5a080a53cfd73f4b958cf7ee3c7008f64

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
42.5MB

MD5
641200bcdccd15a56923fe4e5e5dc446

SHA1
dcf9d71aea87f5a7964488fc569f24829cdc8836

SHA256
d68d313c628545e4930cdc4ae30519a4c957de897f9acc3cf67e0ab9258c54c5

SHA512
b9eb2f7376d689d45a78e906668d523ca59407f107771410622d13db8dd6461d96aa99112aa112514114d9c082fcb401dc622788a3384f83eb038cbeb8274cbc

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
43.4MB

MD5
c1c3acaf370bd29bf5b5c8e0e05c28c1

SHA1
64e3e52e77b19720ff570539cc9c970b2c6c9f4b

SHA256
fbb12648db850cc71d640597a4f09467cb017b5dda0378bddb7c30e6d6a9fb84

SHA512
bd1c7128edb4153f85e658b99007b4852b23c0d9ba5c5ad53bbb56f2ac3bbff1a3c5f316914859aa2ec7b83a20d82b162f95ca6a257f0e5a79890d5b1052f298

Download Submit
memory/364-63-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/364-55-0x00000000047D0000-0x0000000004BA0000-memory.dmp

Filesize
3.8MB

Download
memory/364-54-0x0000000004620000-0x00000000047CA000-memory.dmp

Filesize
1.7MB

Download
memory/844-68-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-74-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-67-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-65-0x0000000004450000-0x00000000045FA000-memory.dmp

Filesize
1.7MB

Download
memory/844-71-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-72-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-73-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-66-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-75-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-76-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-77-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-78-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-79-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/844-80-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download

Analysis

Sharing