laplas | 4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed

Analysis

max time kernel
96s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2023 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3333exe.exe
Size

4.6MB
MD5

10c4eb50adca0b5e5c38ae0fdfa422fc
SHA1

204fa092bd55f6c999733807115dbc5817fd2fa8
SHA256

4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed
SHA512

552fd54a83ba2bb2b64d25890aa1336ca397669fd3dbdf8bc64a3edc2bb4e71aa4207b54b09e3ca050acaf2d4cb4b56740b22152abd047e1627874a8ec968636
SSDEEP

49152:a/7FssC0KqUwzp+Z9vAaE5FKY/t764UzLUA/AOiyjrbsnnzvSn9rsPN/+9rjNvnT:K5sr4V+Zp4UzJ/TknzZ69XOY

Score

10^/10

laplas clipper stealer

Malware Config

Extracted

Family

laplas

clipper.guru

Attributes

api_key
b208717c54146010ab89e628591e2a7b11493ef1c593e7b3f15b1c06b1778d59

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
3244	AlLpDBzutF.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2748	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	66	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3340	1116	3333exe.exe	90
PID 1116 wrote to memory of 3340	1116	3333exe.exe	90
PID 1116 wrote to memory of 3340	1116	3333exe.exe	90
PID 3340 wrote to memory of 2748	3340	cmd.exe	92
PID 3340 wrote to memory of 2748	3340	cmd.exe	92
PID 3340 wrote to memory of 2748	3340	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\3333exe.exe
"C:\Users\Admin\AppData\Local\Temp\3333exe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:2748

C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
1⤵
- Executes dropped EXE
PID:3244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe

Filesize
653.9MB

MD5
f83bb6818b4ae60e52ad15abf52da5de

SHA1
0addff9b0c82085dc01ba5bc360c94d946a14823

SHA256
625b9a222030acdba7159d1e1d562eefcb0ceeb3ed9effa441fde4d236d91e04

SHA512
20e764fbe0439c9a4eee3bd5ea81e302a5064f8bc7727025fe0352d2c3aa4381100820c334ad332562208d5e0b574a1b6e8705b234f44703311378edb616df19

Download Submit
C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe

Filesize
653.9MB

MD5
f83bb6818b4ae60e52ad15abf52da5de

SHA1
0addff9b0c82085dc01ba5bc360c94d946a14823

SHA256
625b9a222030acdba7159d1e1d562eefcb0ceeb3ed9effa441fde4d236d91e04

SHA512
20e764fbe0439c9a4eee3bd5ea81e302a5064f8bc7727025fe0352d2c3aa4381100820c334ad332562208d5e0b574a1b6e8705b234f44703311378edb616df19

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads