laplas | 8eeb353ac1f6b9db69fc2e26784c4464661529a3d4870c7b07f0feb1c3f5ca6e

General

Target

dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe
Size

1.9MB
MD5

6b4854e6cad19b61eda6eb5e68dcfd80
SHA1

f9d95d56f4a68a997154b2e9bc7a362cc1a1dc36
SHA256

dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c
SHA512

bd48825e56e677026c6a6f5d6b74b4bd3f42eeacce2e4b9ec47a6e961ecc4ac692aa3e1b640f6f6ab41c4e0b0403bf8e4f098af12ea3f8366650b7e9576263f9
SSDEEP

49152:ockHSWlipdOYnk04IoVMWPxpCP9I8VYiFFTMQheFE06PXqQ:RkHSWlaOYk9IoVhPxpCP9I8JFFZh3a

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes

api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1300	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1304	dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe
1304	dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1300	1304	dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe	27
PID 1304 wrote to memory of 1300	1304	dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe	27
PID 1304 wrote to memory of 1300	1304	dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe	27
PID 1304 wrote to memory of 1300	1304	dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe	27

C:\Users\Admin\AppData\Local\Temp\dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe
"C:\Users\Admin\AppData\Local\Temp\dcd60ec48ce671c27c2dd6abac75f015e64d5eeb1fdefe9a85bb706e99f2071c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
591.0MB

MD5
0d0094e0c53b7833b38afbbeea02a592

SHA1
f6a254768619126e83b4cad39e048b0533a2e383

SHA256
f506f82916b6a7db1c6dc1bb0c68f365fa614836595fffb45ef5ac0328e6fec7

SHA512
1b4dd47549f19226921df8f29e82170652cda0fce85eae77b2bcc1131127bacd9d1461c345fd0c54e714f422c0479a3ea39c9f127e6e5413294a7f55321e5ab7

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
561.8MB

MD5
c1d4e158f05cc97bcf6004ccda340ff8

SHA1
5796c5f35e4174289cb1c26186c147ea654826ee

SHA256
5d6eb62999d7c9c8faf15c3ca33ae39ce820610cd60b6686fa9f628cb6e7ea70

SHA512
1d498789f57a390a69aa12029c57374e7713e95a8c4c05b16b86ae75cc0bbd9ce787c1e77e6266d96412e8501f56f69827896de53f580235305477e2988b6075

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
385.0MB

MD5
48c3408b680518a8678009fa26d4b494

SHA1
ca2dfda91e12f854806774be920a91c079c474cd

SHA256
b863d4ab6b8b86c268fbab8e8829fb97d7659211693954c68fa662cd926ec540

SHA512
0b24a489685914499d1f059541c2954670cca57ba209e27237b430f83cf7a14d2ea390c9a38042f85d45eeefda503615ba558c27ea18cea8345ed75c55284a67

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
534.8MB

MD5
1a81cceaf76a27fb02ab2a181d60be90

SHA1
601eb1db0574b5a95555b0632796fe8c0a51fa1a

SHA256
05f031ecd827e3ed8cd080d25ab081cf7e2221bfc79bf18017daa3bfddfd2587

SHA512
721b264c661f9ec3205072bc7f1f3acc24843ceace2d3c9c6503ba5f45786d68bf5d6e225139bd1d23833976e19e1f6bad318973c2766b172fce6614066d7fdb

Download Submit
memory/1300-66-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-76-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-80-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-65-0x00000000021D0000-0x000000000237A000-memory.dmp

Filesize
1.7MB

Download
memory/1300-79-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-68-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-71-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-72-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-73-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-74-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-78-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1300-77-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1304-55-0x00000000021F0000-0x00000000025C0000-memory.dmp

Filesize
3.8MB

Download
memory/1304-54-0x0000000002040000-0x00000000021EA000-memory.dmp

Filesize
1.7MB

Download
memory/1304-64-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing