laplas | 2f76513c2b7c8f967a70526fdcf1e5c7976a4a77496e81be277c71fbbfcc3f54

Analysis

max time kernel
150s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.9MB
MD5

181cf5e5f39bbe387b3b985b826b16f1
SHA1

4de92a14f49359ed21c3ee0be536f3126eda37db
SHA256

2f76513c2b7c8f967a70526fdcf1e5c7976a4a77496e81be277c71fbbfcc3f54
SHA512

56acae12a3af47a0ac9cf7261e5e51e4f34fb37fed8026f3694ab013eed3c5a5898733ab0d8dc99294af8b1cd80348f75efc262697b7ccea4c69188a9eb7b6b8
SSDEEP

49152:TkLM27jaMzaTnmg4Gd+cauh5ZvumK3GVtoxRTGs:TGM2GMuCg4h05ZvpILRL

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

5044 ntlhost.exe

pid	process
5044	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	setup.exe

GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 26 Go-http-client/1.1

description	flow	ioc
HTTP User-Agent header	26	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

setup.exe

description	pid	process	target process
PID 2392 wrote to memory of 5044	2392	setup.exe	ntlhost.exe
PID 2392 wrote to memory of 5044	2392	setup.exe	ntlhost.exe
PID 2392 wrote to memory of 5044	2392	setup.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Executes dropped EXE
PID:5044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
760.9MB

MD5
3f050d9990b1dc17458e9675f13352f0

SHA1
2f6d2fc5fa3525cca536012f64bf1d4262cb4ff0

SHA256
5223da38296934f17cc1b6465020579edd46b045daa599a6ed6a7c8a8580d9c7

SHA512
a4046511fa29d08041c14a24e69cd903e0c1d9fad8f988805044f3398c8a2f5548e3f3740271dfb9d5215a7da33e59a3e2c1bc68694443743db2d8a811c102fa

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
760.9MB

MD5
3f050d9990b1dc17458e9675f13352f0

SHA1
2f6d2fc5fa3525cca536012f64bf1d4262cb4ff0

SHA256
5223da38296934f17cc1b6465020579edd46b045daa599a6ed6a7c8a8580d9c7

SHA512
a4046511fa29d08041c14a24e69cd903e0c1d9fad8f988805044f3398c8a2f5548e3f3740271dfb9d5215a7da33e59a3e2c1bc68694443743db2d8a811c102fa

Download Submit
memory/2392-134-0x0000000002730000-0x0000000002B00000-memory.dmp

Filesize
3.8MB

Download
memory/2392-140-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-150-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-156-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-145-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-148-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-141-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-152-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-154-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-143-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-158-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-160-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-162-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-164-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-166-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/5044-168-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download