laplas | 4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed

Analysis

max time kernel
94s
max time network
128s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3333.exe
Size

4.6MB
MD5

10c4eb50adca0b5e5c38ae0fdfa422fc
SHA1

204fa092bd55f6c999733807115dbc5817fd2fa8
SHA256

4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed
SHA512

552fd54a83ba2bb2b64d25890aa1336ca397669fd3dbdf8bc64a3edc2bb4e71aa4207b54b09e3ca050acaf2d4cb4b56740b22152abd047e1627874a8ec968636
SSDEEP

49152:a/7FssC0KqUwzp+Z9vAaE5FKY/t764UzLUA/AOiyjrbsnnzvSn9rsPN/+9rjNvnT:K5sr4V+Zp4UzJ/TknzZ69XOY

Score

10^/10

laplas clipper stealer

Malware Config

Extracted

Family

laplas

clipper.guru

Attributes

api_key
b208717c54146010ab89e628591e2a7b11493ef1c593e7b3f15b1c06b1778d59

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1268	AlLpDBzutF.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1980	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2016	2012	3333.exe	28
PID 2012 wrote to memory of 2016	2012	3333.exe	28
PID 2012 wrote to memory of 2016	2012	3333.exe	28
PID 2012 wrote to memory of 2016	2012	3333.exe	28
PID 2016 wrote to memory of 1980	2016	cmd.exe	30
PID 2016 wrote to memory of 1980	2016	cmd.exe	30
PID 2016 wrote to memory of 1980	2016	cmd.exe	30
PID 2016 wrote to memory of 1980	2016	cmd.exe	30
PID 1408 wrote to memory of 1268	1408	taskeng.exe	32
PID 1408 wrote to memory of 1268	1408	taskeng.exe	32
PID 1408 wrote to memory of 1268	1408	taskeng.exe	32
PID 1408 wrote to memory of 1268	1408	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\3333.exe
"C:\Users\Admin\AppData\Local\Temp\3333.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:1980

C:\Windows\system32\taskeng.exe
taskeng.exe {E868B500-DEA7-4DAC-AE24-6C2CB5DDA50B} S-1-5-21-1306246566-3334493410-3785284834-1000:FQMLBKKW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
  C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
  2⤵
  - Executes dropped EXE
  PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe

Filesize
611.5MB

MD5
952148803a8281f259e137dd9f61a512

SHA1
ec2efc5b52a861f4e4cf8f9cd83f75e5acfe6fe7

SHA256
202a73242713b3029299fac2577a7a0c291f60cfbe0c6dd2d8c7cd94792cb7d8

SHA512
09af678a2e228e6bd2fdc46a864b6578c91c98b7eda47f7740897bd265f724f67a6fcaa2b55f4391baf425397b5f30d3538221cb7c5c00527df4a1f74b4c1d90

Download Submit
C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe

Filesize
611.3MB

MD5
27427797b72153233c47a236c06edfa6

SHA1
781d5f59684d59d96524188c4fddb921c2fd76c4

SHA256
eba67b3d4d52e7e550d13f99a338d3bd0ccf28be9f16a7c165c39258ba964409

SHA512
ef51df97b1549f16ee0e1c333c78333f5b6a45b904de8b6c0e659d4a95f244b7cb471b49b9641ad1d03bfc1b8e547a0a6913bd9369616e6a823e6b72c7ecebc5

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads