laplas | 91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.1MB
MD5

39e1f49a6042aceff8fed09cb3085005
SHA1

d1ec91d7f709776514ce122f43ed78576dd76c79
SHA256

91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee
SHA512

13093115cb8a9ba27d7fab5d2635884da595521a1a9f4fd32c3d395de7ff2fff82c3b275f9486f0a6cc909a7e1ad01a44cd5eb266b3f1f3e8c9f93cd02d31dc1
SSDEEP

12288:LR5lMAN4B9tdhJ3mfCqgdDOImbiaobw5:Lni7J+gdD8bmbs

Score

10^/10

laplas redline 1 clipper infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

95.216.249.153:81

Attributes

auth_value
a290efd4796d37556cc5af7e83c91346

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
ab77c1513d42148558312d676282a204d8aa055051d315af2056241c7f79c6f4

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
ab77c1513d42148558312d676282a204d8aa055051d315af2056241c7f79c6f4

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2512	Upshot_o.exe
640	ajetr2fx.exe
3656	Doej4oa.exe
7520	ntlhost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	Doej4oa.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run	Upshot_o.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\Upshot_o.exe'\""	Upshot_o.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 636	4840	file.exe	86
PID 640 set thread context of 3412	640	ajetr2fx.exe	100

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2216	4840	WerFault.exe	84
3884	640	WerFault.exe	98

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	78	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
636	RegSvcs.exe
636	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	RegSvcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 4840 wrote to memory of 636	4840	file.exe	86
PID 636 wrote to memory of 2512	636	RegSvcs.exe	96
PID 636 wrote to memory of 2512	636	RegSvcs.exe	96
PID 636 wrote to memory of 2512	636	RegSvcs.exe	96
PID 636 wrote to memory of 640	636	RegSvcs.exe	98
PID 636 wrote to memory of 640	636	RegSvcs.exe	98
PID 636 wrote to memory of 640	636	RegSvcs.exe	98
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 640 wrote to memory of 3412	640	ajetr2fx.exe	100
PID 636 wrote to memory of 3656	636	RegSvcs.exe	105
PID 636 wrote to memory of 3656	636	RegSvcs.exe	105
PID 636 wrote to memory of 3656	636	RegSvcs.exe	105
PID 3656 wrote to memory of 7520	3656	Doej4oa.exe	106
PID 3656 wrote to memory of 7520	3656	Doej4oa.exe	106
PID 3656 wrote to memory of 7520	3656	Doej4oa.exe	106

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe
    "C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe
    "C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:3412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 288
      4⤵
      Program crash
      PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe
    "C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:7520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 136
  2⤵
  - Program crash
  PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4840 -ip 4840
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 640 -ip 640
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe

Filesize
3.8MB

MD5
68be007bd3fa09d26fcee584a9157770

SHA1
6f191c0587c8055f26367f25ce0f7787ca272714

SHA256
71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e

SHA512
f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe

Filesize
3.8MB

MD5
68be007bd3fa09d26fcee584a9157770

SHA1
6f191c0587c8055f26367f25ce0f7787ca272714

SHA256
71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e

SHA512
f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doej4oa.exe

Filesize
3.8MB

MD5
68be007bd3fa09d26fcee584a9157770

SHA1
6f191c0587c8055f26367f25ce0f7787ca272714

SHA256
71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e

SHA512
f6c774453eae56e95761951315d37700e44b6c04ea07e0e6b46fe4a87943f051206a5dd618b4f632ff926fbb4be94fe7925c46d115a25941c084cb8fb513a245

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe

Filesize
6.5MB

MD5
583336f1531f78ffc2cc8ef84da256e1

SHA1
a4cb0c4123c5bb8abd45d8d320c44782d4de3e33

SHA256
0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411

SHA512
f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe

Filesize
6.5MB

MD5
583336f1531f78ffc2cc8ef84da256e1

SHA1
a4cb0c4123c5bb8abd45d8d320c44782d4de3e33

SHA256
0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411

SHA512
f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Upshot_o.exe

Filesize
6.5MB

MD5
583336f1531f78ffc2cc8ef84da256e1

SHA1
a4cb0c4123c5bb8abd45d8d320c44782d4de3e33

SHA256
0218aabfe9a1a51116ff85ce7bbba907ded9ca015d23fe2e8e494d695ab9f411

SHA512
f1daa8357a6995fe5be8394d54350df4be9494319261fbb80bd812e9b2c9cecf4c3810d29f872a2f37bd186c2574526155dfd3ea75f5499a03ed8e9df37524e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe

Filesize
3.4MB

MD5
72046d312a90409c7a554eba07e1f3e8

SHA1
f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a

SHA256
0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e

SHA512
59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe

Filesize
3.4MB

MD5
72046d312a90409c7a554eba07e1f3e8

SHA1
f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a

SHA256
0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e

SHA512
59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajetr2fx.exe

Filesize
3.4MB

MD5
72046d312a90409c7a554eba07e1f3e8

SHA1
f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a

SHA256
0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e

SHA512
59268669d37f656b3229d611e5f1c9828450cf4bc1d00d2957938bde7a1c1cfdfbb06dd593517dddf902498c4aa34176b046e0c8a6b08b5e91201265bf0ea5ba

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
358.6MB

MD5
90f40b3d8b46a2871d00073b1055043c

SHA1
0fe4143eddb9c8a66e44ef83f139a6faaedda5e3

SHA256
181d6855fbb2e767182a0e1aa4f65950db9610b8c1fed7dbf50d9fa7c30708fe

SHA512
8950e24ddc609be140d565f0c3c486fb1870ffcf2eece6a56d4d58e74cd44744b84ec58e461b32b89994bf418bb4cb5446f2a5e79bc6e28d37b08a557ba3dedc

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
349.6MB

MD5
3270d69514d5f090b1dc43241996b7b0

SHA1
b993a2c6a7bb5684dbd4b00cda8a65b83b32a511

SHA256
8bb27b893d13bf130401ba4606be7ef66af6e61af4fa34a2aea29908a52e1452

SHA512
a56029bf805c97be594f62de42a02ea9bc9117df64fe42f87862ec547f022446c12f8a26fc640fc716a2a74e5fc1295303a1c491a32e03bf969cf48f532ac2c4

Download Submit
memory/636-145-0x00000000070D0000-0x0000000007674000-memory.dmp

Filesize
5.6MB

Download
memory/636-138-0x0000000005D10000-0x0000000006328000-memory.dmp

Filesize
6.1MB

Download
memory/636-150-0x0000000008DF0000-0x000000000931C000-memory.dmp

Filesize
5.2MB

Download
memory/636-148-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/636-147-0x0000000006EC0000-0x0000000006F10000-memory.dmp

Filesize
320KB

Download
memory/636-146-0x0000000006C00000-0x0000000006C66000-memory.dmp

Filesize
408KB

Download
memory/636-149-0x00000000086F0000-0x00000000088B2000-memory.dmp

Filesize
1.8MB

Download
memory/636-142-0x00000000031A0000-0x00000000031DC000-memory.dmp

Filesize
240KB

Download
memory/636-139-0x0000000005800000-0x000000000590A000-memory.dmp

Filesize
1.0MB

Download
memory/636-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/636-144-0x0000000005A30000-0x0000000005AC2000-memory.dmp

Filesize
584KB

Download
memory/636-143-0x0000000005910000-0x0000000005986000-memory.dmp

Filesize
472KB

Download
memory/636-140-0x0000000003020000-0x0000000003032000-memory.dmp

Filesize
72KB

Download
memory/636-141-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/2512-160-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Filesize
24KB

Download
memory/2512-161-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Filesize
24KB

Download
memory/2512-162-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Filesize
24KB

Download
memory/3412-192-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/3412-194-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/3412-191-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/3412-190-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/3412-171-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download