laplas | 9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12

General

Target

9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe
Size

1.8MB
MD5

0a935300ad790ad8d03666b1f14e73a4
SHA1

57bf66e15b0cbf325ce66d4c9d5592088a1a8e00
SHA256

9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12
SHA512

64e7c5e9b0c301a2b4a87dc0189fa55bc7c8690d9148382fd237851348a977376a9772c232f6a898417e92e739add1410d3f143f93547eb99c57fa064ce78096
SSDEEP

49152:HRS3ddTQVvnRdoXwG1a/MrkK9daCBCimRL6E84TB:xSk4XwG1lr0PR8iB

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1244	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1248	9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe
1248	9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1244	1248	9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe	28
PID 1248 wrote to memory of 1244	1248	9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe	28
PID 1248 wrote to memory of 1244	1248	9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe	28
PID 1248 wrote to memory of 1244	1248	9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe	28

C:\Users\Admin\AppData\Local\Temp\9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe
"C:\Users\Admin\AppData\Local\Temp\9b96d15a412a80fb77e790070084ce815945398f9c9b103ece0ed420850ace12.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
801.8MB

MD5
2d540de1c4cfc7966de8639ff4d92986

SHA1
12068a7503eff8ebc9bb6393e195cbaecc6e1b08

SHA256
910270aa6e3894d3a1f95f3cee5233a1e7020896ef4e9245a7dec3364fe311cb

SHA512
a7b651af20ed810bb29caac1859f6ea7c423ebb070b7d3517b8decf6e70e23ecf2b9d6eb47df7865b49a24099e8c9fbe3bb42f6e83b591e7fc0d734478000e40

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
801.8MB

MD5
2d540de1c4cfc7966de8639ff4d92986

SHA1
12068a7503eff8ebc9bb6393e195cbaecc6e1b08

SHA256
910270aa6e3894d3a1f95f3cee5233a1e7020896ef4e9245a7dec3364fe311cb

SHA512
a7b651af20ed810bb29caac1859f6ea7c423ebb070b7d3517b8decf6e70e23ecf2b9d6eb47df7865b49a24099e8c9fbe3bb42f6e83b591e7fc0d734478000e40

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
801.8MB

MD5
2d540de1c4cfc7966de8639ff4d92986

SHA1
12068a7503eff8ebc9bb6393e195cbaecc6e1b08

SHA256
910270aa6e3894d3a1f95f3cee5233a1e7020896ef4e9245a7dec3364fe311cb

SHA512
a7b651af20ed810bb29caac1859f6ea7c423ebb070b7d3517b8decf6e70e23ecf2b9d6eb47df7865b49a24099e8c9fbe3bb42f6e83b591e7fc0d734478000e40

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
801.8MB

MD5
2d540de1c4cfc7966de8639ff4d92986

SHA1
12068a7503eff8ebc9bb6393e195cbaecc6e1b08

SHA256
910270aa6e3894d3a1f95f3cee5233a1e7020896ef4e9245a7dec3364fe311cb

SHA512
a7b651af20ed810bb29caac1859f6ea7c423ebb070b7d3517b8decf6e70e23ecf2b9d6eb47df7865b49a24099e8c9fbe3bb42f6e83b591e7fc0d734478000e40

Download Submit
memory/1244-78-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-79-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-95-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-64-0x00000000020B0000-0x000000000225A000-memory.dmp

Filesize
1.7MB

Download
memory/1244-66-0x0000000002270000-0x0000000002640000-memory.dmp

Filesize
3.8MB

Download
memory/1244-67-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-68-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-69-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-72-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-73-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-74-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-75-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-76-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-77-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-94-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-93-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-80-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-81-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-82-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-83-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-84-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-85-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-86-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-87-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-88-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-89-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-90-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-91-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1244-92-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1248-65-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1248-54-0x00000000021E0000-0x000000000238A000-memory.dmp

Filesize
1.7MB

Download
memory/1248-55-0x0000000002390000-0x0000000002760000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing