laplas | 483fde1fba538fd23eff241ac85960f2710850c8bcb7bde0024e298d065fc01d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.8MB
MD5

f465d008c8ac27c3946376b5a5a9f5f9
SHA1

614b5376bfb761e2177af0b5c097081d31689883
SHA256

483fde1fba538fd23eff241ac85960f2710850c8bcb7bde0024e298d065fc01d
SHA512

beaca0330c79e27a2eae1770cf448e4e021d0aab6f918bc97e848d1ced85cd7d2fab00841abc65dc53ebb973a21b2efdaa1d94d6a7a01428ceb0456ebcb1f79e
SSDEEP

49152:W7WhJ7cYDtLPUx4Pz6zqhxldCkVjBVn9:WkN7xIq+zqh7wkrVn

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

2336 ntlhost.exe

pid	process
2336	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	setup.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 2276 WerFault.exe setup.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 17 Go-http-client/1.1

pid	pid_target	process	target process
1276	2276	WerFault.exe	setup.exe

description	flow	ioc
HTTP User-Agent header	17	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

setup.exe

description	pid	process	target process
PID 2276 wrote to memory of 2336	2276	setup.exe	ntlhost.exe
PID 2276 wrote to memory of 2336	2276	setup.exe	ntlhost.exe
PID 2276 wrote to memory of 2336	2276	setup.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Executes dropped EXE
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 792
2⤵
- Program crash
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2276 -ip 2276
1⤵
PID:4828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
840.8MB

MD5
75c22f17e6dee844a1b7241524d0fedd

SHA1
90c3bb267012f72bf82ab1e7be2ac266651b33f5

SHA256
f93282f8bedb41d86355f53017ca65b8171617cd70c5d9793c6356411421fdce

SHA512
15de93a2050508d4ab0fabc4950d1dc1a57d4bc8843148005c2d6c0692ef04c596162f49f2a1833df998f77de1747ebca4fa730b11c9a023a8d4985138df1237

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
840.8MB

MD5
75c22f17e6dee844a1b7241524d0fedd

SHA1
90c3bb267012f72bf82ab1e7be2ac266651b33f5

SHA256
f93282f8bedb41d86355f53017ca65b8171617cd70c5d9793c6356411421fdce

SHA512
15de93a2050508d4ab0fabc4950d1dc1a57d4bc8843148005c2d6c0692ef04c596162f49f2a1833df998f77de1747ebca4fa730b11c9a023a8d4985138df1237

Download Submit
memory/2276-134-0x0000000002730000-0x0000000002B00000-memory.dmp

Filesize
3.8MB

Download
memory/2276-140-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-146-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-149-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-143-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-145-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-141-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-147-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-148-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-142-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-150-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-151-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-152-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-153-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-154-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/2336-155-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download