laplas | 91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.1MB
MD5

39e1f49a6042aceff8fed09cb3085005
SHA1

d1ec91d7f709776514ce122f43ed78576dd76c79
SHA256

91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee
SHA512

13093115cb8a9ba27d7fab5d2635884da595521a1a9f4fd32c3d395de7ff2fff82c3b275f9486f0a6cc909a7e1ad01a44cd5eb266b3f1f3e8c9f93cd02d31dc1
SSDEEP

12288:LR5lMAN4B9tdhJ3mfCqgdDOImbiaobw5:Lni7J+gdD8bmbs

Score

10^/10

laplas redline 1 clipper infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

95.216.249.153:81

Attributes

auth_value
a290efd4796d37556cc5af7e83c91346

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
ab77c1513d42148558312d676282a204d8aa055051d315af2056241c7f79c6f4

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
ab77c1513d42148558312d676282a204d8aa055051d315af2056241c7f79c6f4

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
5008	Upshot_o.exe
4996	ajetr2fx.exe
1396	Doej4oa.exe
7736	ntlhost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	Doej4oa.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run	Upshot_o.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\Upshot_o.exe'\""	Upshot_o.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 2008	2288	file.exe	84
PID 4996 set thread context of 4208	4996	ajetr2fx.exe	98

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1800	2288	WerFault.exe	82
3460	4996	WerFault.exe	96

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	53	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2008	RegSvcs.exe
2008	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	RegSvcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2008	2288	file.exe	84
PID 2288 wrote to memory of 2008	2288	file.exe	84
PID 2288 wrote to memory of 2008	2288	file.exe	84
PID 2288 wrote to memory of 2008	2288	file.exe	84
PID 2288 wrote to memory of 2008	2288	file.exe	84
PID 2008 wrote to memory of 5008	2008	RegSvcs.exe	93
PID 2008 wrote to memory of 5008	2008	RegSvcs.exe	93
PID 2008 wrote to memory of 5008	2008	RegSvcs.exe	93
PID 2008 wrote to memory of 4996	2008	RegSvcs.exe	96
PID 2008 wrote to memory of 4996	2008	RegSvcs.exe	96
PID 2008 wrote to memory of 4996	2008	RegSvcs.exe	96
PID 4996 wrote to memory of 4208	4996	ajetr2fx.exe	98
PID 4996 wrote to memory of 4208	4996	ajetr2fx.exe	98
PID 4996 wrote to memory of 4208	4996	ajetr2fx.exe	98
PID 4996 wrote to memory of 4208	4996	ajetr2fx.exe	98
PID 4996 wrote to memory of 4208	4996	ajetr2fx.exe	98
PID 2008 wrote to memory of 1396	2008	RegSvcs.exe	102
PID 2008 wrote to memory of 1396	2008	RegSvcs.exe	102
PID 2008 wrote to memory of 1396	2008	RegSvcs.exe	102
PID 1396 wrote to memory of 7736	1396	Doej4oa.exe	103
PID 1396 wrote to memory of 7736	1396	Doej4oa.exe	103
PID 1396 wrote to memory of 7736	1396	Doej4oa.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe
    "C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe
    "C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 152
      4⤵
      Program crash
      PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe
    "C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:7736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 148
  2⤵
  - Program crash
  PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2288 -ip 2288
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4996 -ip 4996
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe

Filesize
3.8MB

MD5
68be007bd3fa09d26fcee584a9157770

SHA1
6f191c0587c8055f26367f25ce0f7787ca272714

SHA256
71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e

SHA512
f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe

Filesize
3.8MB

MD5
68be007bd3fa09d26fcee584a9157770

SHA1
6f191c0587c8055f26367f25ce0f7787ca272714

SHA256
71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e

SHA512
f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe

Filesize
3.8MB

MD5
68be007bd3fa09d26fcee584a9157770

SHA1
6f191c0587c8055f26367f25ce0f7787ca272714

SHA256
71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e

SHA512
f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe

Filesize
6.5MB

MD5
583336f1531f78ffc2cc8ef84da256e1

SHA1
a4cb0c4123c5bb8abd45d8d320c44782d4de3e33

SHA256
0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411

SHA512
f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe

Filesize
6.5MB

MD5
583336f1531f78ffc2cc8ef84da256e1

SHA1
a4cb0c4123c5bb8abd45d8d320c44782d4de3e33

SHA256
0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411

SHA512
f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe

Filesize
6.5MB

MD5
583336f1531f78ffc2cc8ef84da256e1

SHA1
a4cb0c4123c5bb8abd45d8d320c44782d4de3e33

SHA256
0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411

SHA512
f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe

Filesize
3.4MB

MD5
72046d312a90409c7a554eba07e1f3e8

SHA1
f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a

SHA256
0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e

SHA512
59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe

Filesize
3.4MB

MD5
72046d312a90409c7a554eba07e1f3e8

SHA1
f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a

SHA256
0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e

SHA512
59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe

Filesize
3.4MB

MD5
72046d312a90409c7a554eba07e1f3e8

SHA1
f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a

SHA256
0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e

SHA512
59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
276.7MB

MD5
f03f122e80e0fc99dd0eaf25abe6bf39

SHA1
9030db8c32ca319f01dc5507ec65e1ecf4f71380

SHA256
ee990ea4dffc8ffecd0300dab82addc60c3856b5a5f082a1943b7e1ec5648658

SHA512
cf2ace46d8ee5757106d4e324317cb6e0b4144d36320166ff67f83a947de7416f2913d0dbbba7d1225f0499765948a749f489defbc79746e5f9bb27ac0036e66

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
286.9MB

MD5
b47b5c710864f88fb811c8704ce2dd8e

SHA1
d7c46baa2c65dd17f57e701a7e9a15d7767d2b01

SHA256
d6b3fc3c681e3d7b2f8e7a06b8550469533dd0da20bda6e95e7cff7035025ee0

SHA512
0e87db7b6b9c1d48aa6e0a56314c9a1ecf983f679a0a8e0b6c5fb2ec063a572628a1aad0a7a1caa9b263be7afadd1cdeb4a6dde3141fc377e1d83a7bc3916a4b

Download Submit
memory/2008-145-0x0000000006BC0000-0x0000000006C26000-memory.dmp

Filesize
408KB

Download
memory/2008-139-0x0000000005780000-0x000000000588A000-memory.dmp

Filesize
1.0MB

Download
memory/2008-150-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2008-148-0x0000000008F80000-0x00000000094AC000-memory.dmp

Filesize
5.2MB

Download
memory/2008-147-0x0000000006FF0000-0x00000000071B2000-memory.dmp

Filesize
1.8MB

Download
memory/2008-146-0x00000000089D0000-0x0000000008F74000-memory.dmp

Filesize
5.6MB

Download
memory/2008-138-0x0000000005C70000-0x0000000006288000-memory.dmp

Filesize
6.1MB

Download
memory/2008-149-0x0000000006F00000-0x0000000006F50000-memory.dmp

Filesize
320KB

Download
memory/2008-140-0x00000000056C0000-0x00000000056D2000-memory.dmp

Filesize
72KB

Download
memory/2008-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2008-144-0x0000000005B50000-0x0000000005BE2000-memory.dmp

Filesize
584KB

Download
memory/2008-143-0x0000000005A30000-0x0000000005AA6000-memory.dmp

Filesize
472KB

Download
memory/2008-141-0x0000000005720000-0x000000000575C000-memory.dmp

Filesize
240KB

Download
memory/2008-142-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/4208-194-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/4208-192-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/4208-191-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/4208-190-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/4208-171-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/5008-162-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download
memory/5008-161-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download
memory/5008-160-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download