laplas | 4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed

Analysis

max time kernel
72s
max time network
142s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01-07-2023 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3333exe.exe
Size

4.6MB
MD5

10c4eb50adca0b5e5c38ae0fdfa422fc
SHA1

204fa092bd55f6c999733807115dbc5817fd2fa8
SHA256

4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed
SHA512

552fd54a83ba2bb2b64d25890aa1336ca397669fd3dbdf8bc64a3edc2bb4e71aa4207b54b09e3ca050acaf2d4cb4b56740b22152abd047e1627874a8ec968636
SSDEEP

49152:a/7FssC0KqUwzp+Z9vAaE5FKY/t764UzLUA/AOiyjrbsnnzvSn9rsPN/+9rjNvnT:K5sr4V+Zp4UzJ/TknzZ69XOY

Score

10^/10

laplas clipper stealer

Malware Config

Extracted

Family

laplas

clipper.guru

Attributes

api_key
b208717c54146010ab89e628591e2a7b11493ef1c593e7b3f15b1c06b1778d59

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1188	AlLpDBzutF.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1708	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2000	2012	3333exe.exe	28
PID 2012 wrote to memory of 2000	2012	3333exe.exe	28
PID 2012 wrote to memory of 2000	2012	3333exe.exe	28
PID 2012 wrote to memory of 2000	2012	3333exe.exe	28
PID 2000 wrote to memory of 1708	2000	cmd.exe	30
PID 2000 wrote to memory of 1708	2000	cmd.exe	30
PID 2000 wrote to memory of 1708	2000	cmd.exe	30
PID 2000 wrote to memory of 1708	2000	cmd.exe	30
PID 764 wrote to memory of 1188	764	taskeng.exe	32
PID 764 wrote to memory of 1188	764	taskeng.exe	32
PID 764 wrote to memory of 1188	764	taskeng.exe	32
PID 764 wrote to memory of 1188	764	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\3333exe.exe
"C:\Users\Admin\AppData\Local\Temp\3333exe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:1708

C:\Windows\system32\taskeng.exe
taskeng.exe {C6531E8B-6D04-45D9-99EC-D8E78E69D99D} S-1-5-21-3465915139-4244146034-2076118314-1000:MSOKFDFP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
  C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
  2⤵
  - Executes dropped EXE
  PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe

Filesize
730.1MB

MD5
63e45b652d728bd704ce35e9317b0537

SHA1
64f55d63a7d205169c3490f74574fbc4a6ecc01f

SHA256
664f1f50541e11aad0a5c410b51bf4caf971ea5ae119f9f2b4c705328fb4e12a

SHA512
9845ec38801ca669543d076b2945ce54b4d8c1c993f0789688fc8c04c82e61023e995907656da87d839e359f78299cac91362e06daea2b52b9665bbc7e4f9bf4

Download Submit
C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe

Filesize
730.1MB

MD5
63e45b652d728bd704ce35e9317b0537

SHA1
64f55d63a7d205169c3490f74574fbc4a6ecc01f

SHA256
664f1f50541e11aad0a5c410b51bf4caf971ea5ae119f9f2b4c705328fb4e12a

SHA512
9845ec38801ca669543d076b2945ce54b4d8c1c993f0789688fc8c04c82e61023e995907656da87d839e359f78299cac91362e06daea2b52b9665bbc7e4f9bf4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads