laplas | 91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2023, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.1MB
Sample230612-la4pnsbb78
SHA256 91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee
MD5 39e1f49a6042aceff8fed09cb3085005
SHA1 d1ec91d7f709776514ce122f43ed78576dd76c79
SHA512 13093115cb8a9ba27d7fab5d2635884da595521a1a9f4fd32c3d395de7ff2fff82c3b275f9486f0a6cc909a7e1ad01a44cd5eb266b3f1f3e8c9f93cd02d31dc1
SSDEEP 12288:LR5lMAN4B9tdhJ3mfCqgdDOImbiaobw5:Lni7J+gdD8bmbs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas redline 1 clipper infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

95.216.249.153:81

Attributes

auth_value
a290efd4796d37556cc5af7e83c91346

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
ab77c1513d42148558312d676282a204d8aa055051d315af2056241c7f79c6f4

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
ab77c1513d42148558312d676282a204d8aa055051d315af2056241c7f79c6f4

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2512	Upshot_o.exe
640	ajetr2fx.exe
3656	Doej4oa.exe
7520	ntlhost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	Doej4oa.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run	Upshot_o.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\Upshot_o.exe'\""	Upshot_o.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 636	4840	file.exe	86
PID 640 set thread context of 3412	640	ajetr2fx.exe	100

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2216	4840	WerFault.exe	84
3884	640	WerFault.exe	98

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	78	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
636	RegSvcs.exe
636	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	RegSvcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 636 wrote to memory of 2512	636	RegSvcs.exe	96
PID 636 wrote to memory of 2512	636	RegSvcs.exe	96
PID 636 wrote to memory of 2512	636	RegSvcs.exe	96
PID 636 wrote to memory of 640	636	RegSvcs.exe	98
PID 636 wrote to memory of 640	636	RegSvcs.exe	98
PID 636 wrote to memory of 640	636	RegSvcs.exe	98
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 636 wrote to memory of 3656	636	RegSvcs.exe	105
PID 636 wrote to memory of 3656	636	RegSvcs.exe	105
PID 636 wrote to memory of 3656	636	RegSvcs.exe	105
PID 3656 wrote to memory of 7520	3656	Doej4oa.exe	106
PID 3656 wrote to memory of 7520	3656	Doej4oa.exe	106
PID 3656 wrote to memory of 7520	3656	Doej4oa.exe	106

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe
    "C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe
    "C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:3412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 288
      4⤵
      Program crash
      PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe
    "C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:7520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 136
  2⤵
  - Program crash
  PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4840 -ip 4840
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 640 -ip 640
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Doej4oa.exe

Path C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe
Size 3.8MB
SHA256 71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e
MD5 68be007bd3fa09d26fcee584a9157770
SHA1 6f191c0587c8055f26367f25ce0f7787ca272714
SHA512 f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245
SSDEEP 49152:VeCseICR7NWm8qpHakXvLQh0/50OicF5pDRXxRv0VF14L:VeCrXv0W/tpDRX5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Doej4oa.exe

Path C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe
Size 3.8MB
SHA256 71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e
MD5 68be007bd3fa09d26fcee584a9157770
SHA1 6f191c0587c8055f26367f25ce0f7787ca272714
SHA512 f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245
SSDEEP 49152:VeCseICR7NWm8qpHakXvLQh0/50OicF5pDRXxRv0VF14L:VeCrXv0W/tpDRX5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Doej4oa.exe

Path C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe
Size 3.8MB
SHA256 71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e
MD5 68be007bd3fa09d26fcee584a9157770
SHA1 6f191c0587c8055f26367f25ce0f7787ca272714
SHA512 f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245
SSDEEP 49152:VeCseICR7NWm8qpHakXvLQh0/50OicF5pDRXxRv0VF14L:VeCrXv0W/tpDRX5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Upshot_o.exe

Path C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe
Size 6.5MB
SHA256 0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411
MD5 583336f1531f78ffc2cc8ef84da256e1
SHA1 a4cb0c4123c5bb8abd45d8d320c44782d4de3e33
SHA512 f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8
SSDEEP 98304:NZH5qVZdLLHnFh3l7BKe70WWGoqZ92yqG/uzGNVAHkAVHLKDKmFfWp:NSZNLl8xByQyqG/uzGNVFAlcK8fWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Upshot_o.exe

Path C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe
Size 6.5MB
SHA256 0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411
MD5 583336f1531f78ffc2cc8ef84da256e1
SHA1 a4cb0c4123c5bb8abd45d8d320c44782d4de3e33
SHA512 f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8
SSDEEP 98304:NZH5qVZdLLHnFh3l7BKe70WWGoqZ92yqG/uzGNVAHkAVHLKDKmFfWp:NSZNLl8xByQyqG/uzGNVFAlcK8fWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Upshot_o.exe

Path C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe
Size 6.5MB
SHA256 0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411
MD5 583336f1531f78ffc2cc8ef84da256e1
SHA1 a4cb0c4123c5bb8abd45d8d320c44782d4de3e33
SHA512 f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8
SSDEEP 98304:NZH5qVZdLLHnFh3l7BKe70WWGoqZ92yqG/uzGNVAHkAVHLKDKmFfWp:NSZNLl8xByQyqG/uzGNVFAlcK8fWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajetr2fx.exe

Path C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe
Size 3.4MB
SHA256 0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e
MD5 72046d312a90409c7a554eba07e1f3e8
SHA1 f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a
SHA512 59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba
SSDEEP 98304:fs2i2w6gC+FgBrG0vCGBbrbkUAv23vKe0f4GY/5:pw6gC+FgBrGyK2GY/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajetr2fx.exe

Path C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe
Size 3.4MB
SHA256 0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e
MD5 72046d312a90409c7a554eba07e1f3e8
SHA1 f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a
SHA512 59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba
SSDEEP 98304:fs2i2w6gC+FgBrG0vCGBbrbkUAv23vKe0f4GY/5:pw6gC+FgBrGyK2GY/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajetr2fx.exe

Path C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe
Size 3.4MB
SHA256 0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e
MD5 72046d312a90409c7a554eba07e1f3e8
SHA1 f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a
SHA512 59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba
SSDEEP 98304:fs2i2w6gC+FgBrG0vCGBbrbkUAv23vKe0f4GY/5:pw6gC+FgBrGyK2GY/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 358.6MB
SHA256 181d6855fbb2e767182a0e1aa4f65950db9610b8c1fed7dbf50d9fa7c30708fe
MD5 90f40b3d8b46a2871d00073b1055043c
SHA1 0fe4143eddb9c8a66e44ef83f139a6faaedda5e3
SHA512 8950e24ddc609be140d565f0c3c486fb1870ffcf2eece6a56d4d58e74cd44744b84ec58e461b32b89994bf418bb4cb5446f2a5e79bc6e28d37b08a557ba3dedc
SSDEEP 6291456:Mpl27+9z1qjLMXIwVhDDIGmR3RHYPPxoq2V+SstqIFqmXH/wkk7eYwTSViR4+fS:o2gzMEXthnwCRoqQSFkeYlMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 349.6MB
SHA256 8bb27b893d13bf130401ba4606be7ef66af6e61af4fa34a2aea29908a52e1452
MD5 3270d69514d5f090b1dc43241996b7b0
SHA1 b993a2c6a7bb5684dbd4b00cda8a65b83b32a511
SHA512 a56029bf805c97be594f62de42a02ea9bc9117df64fe42f87862ec547f022446c12f8a26fc640fc716a2a74e5fc1295303a1c491a32e03bf969cf48f532ac2c4
SSDEEP 6291456:Mpl27+9z1qjLMXIwVhDDIGmR3RHYPPxoq2V+SstqIFqmXH/wkk7eYwTSViR4+fg:o2gzMEXthnwCRoqQSFkeYlMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/636-145-0x00000000070D0000-0x0000000007674000-memory.dmp

Download

memory/636-138-0x0000000005D10000-0x0000000006328000-memory.dmp

Download

memory/636-150-0x0000000008DF0000-0x000000000931C000-memory.dmp

Download

memory/636-148-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/636-147-0x0000000006EC0000-0x0000000006F10000-memory.dmp

Download

memory/636-146-0x0000000006C00000-0x0000000006C66000-memory.dmp

Download

memory/636-149-0x00000000086F0000-0x00000000088B2000-memory.dmp

Download

memory/636-142-0x00000000031A0000-0x00000000031DC000-memory.dmp

Download

memory/636-139-0x0000000005800000-0x000000000590A000-memory.dmp

Download

memory/636-133-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/636-144-0x0000000005A30000-0x0000000005AC2000-memory.dmp

Download

memory/636-143-0x0000000005910000-0x0000000005986000-memory.dmp

Download

memory/636-140-0x0000000003020000-0x0000000003032000-memory.dmp

Download

memory/636-141-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/2512-160-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Download

memory/2512-161-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Download

memory/2512-162-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Download

memory/3412-192-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3412-194-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3412-191-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3412-190-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/3412-171-0x0000000000400000-0x000000000056C000-memory.dmp

Download