laplas | 8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051.exe
Size

1.9MB
MD5

5419d85dbbb8c57fb337f1490b3d6c21
SHA1

780a46377db73dc921d3a7795412b4405ea290bf
SHA256

8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051
SHA512

e1d84bb5105f62fe53c2be15d6c5f1c64accb17960aa1aa9cf2be7fef5a2de695bd0d11bc1c4d5f6ede8923f59847a6f5c052091ecf93a3ff3d10747b38d33ab
SSDEEP

49152:d/P9nuxcamIidEoNDD1eHi8xvrRoHvVHQx2HylA5:dn9nMcaZidz/1eHBxvrqvefA5

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2988	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	43	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 2988	4268	8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051.exe	91
PID 4268 wrote to memory of 2988	4268	8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051.exe	91
PID 4268 wrote to memory of 2988	4268	8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051.exe	91

C:\Users\Admin\AppData\Local\Temp\8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051.exe
"C:\Users\Admin\AppData\Local\Temp\8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
769.9MB

MD5
d275f134a78a2d26c5c3535f77dac3ec

SHA1
ae6feee7110a50eefbadb7fc5629444cfa4cc86c

SHA256
9d0b7281984235297dc902b2a553f2157c8684ebf7ff8577d5f07c413fcf7acf

SHA512
0052d53f3dc19877cdffe1460cf0e734d2bf7f386a852d8440131a509c83dd9ccb6b9cb44dab0bfe8a059f7779810bc4341ac4b74e1ca7a1c2a3efe19d6ee55f

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
769.9MB

MD5
d275f134a78a2d26c5c3535f77dac3ec

SHA1
ae6feee7110a50eefbadb7fc5629444cfa4cc86c

SHA256
9d0b7281984235297dc902b2a553f2157c8684ebf7ff8577d5f07c413fcf7acf

SHA512
0052d53f3dc19877cdffe1460cf0e734d2bf7f386a852d8440131a509c83dd9ccb6b9cb44dab0bfe8a059f7779810bc4341ac4b74e1ca7a1c2a3efe19d6ee55f

Download Submit
memory/2988-150-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-149-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-156-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-142-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-143-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-144-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-146-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-147-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-148-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-155-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-154-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-151-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-152-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/2988-153-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/4268-134-0x00000000028F0000-0x0000000002CC0000-memory.dmp

Filesize
3.8MB

Download
memory/4268-136-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download
memory/4268-139-0x0000000000400000-0x00000000009D7000-memory.dmp

Filesize
5.8MB

Download