laplas | da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e.exe
Size

1.8MB
MD5

d5c139fe384e12358c394790b740a429
SHA1

835188fc822341f9226c13412e00f45d666b85f2
SHA256

da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e
SHA512

08c7781bfe816ff698e2b7cde8bf4a7c5581a2c7c372d1dc51375af5625b9b4132b380c2a2bdbc028f3ad3a02574baf312d1249acb26abc4585a3bfecc670506
SSDEEP

49152:c8ePKunHP5Iax4v+f2w0GVbTRvCO75Sc7RMP:cjKuN7vJ75LRs

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1336	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1336	548	da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e.exe	96
PID 548 wrote to memory of 1336	548	da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e.exe	96
PID 548 wrote to memory of 1336	548	da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e.exe	96

C:\Users\Admin\AppData\Local\Temp\da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e.exe
"C:\Users\Admin\AppData\Local\Temp\da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
717.8MB

MD5
d019d58164c5d9317f934f6a0f111523

SHA1
5bbe267a3576cb1e49fbfdc8f4d1eb54f2f81ba1

SHA256
45387c58b8958a04677a451f5b17e0b595595db8238f0b99a1c2bf15c162d872

SHA512
0512c299c5cdab6fb89307cd1c4552685bbcdb3844a161c98f5a0c5c85d33356c43009b3ef4caca6261d400a768a0e8c4ec239339daff95edb60f6234c982d1e

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
717.8MB

MD5
d019d58164c5d9317f934f6a0f111523

SHA1
5bbe267a3576cb1e49fbfdc8f4d1eb54f2f81ba1

SHA256
45387c58b8958a04677a451f5b17e0b595595db8238f0b99a1c2bf15c162d872

SHA512
0512c299c5cdab6fb89307cd1c4552685bbcdb3844a161c98f5a0c5c85d33356c43009b3ef4caca6261d400a768a0e8c4ec239339daff95edb60f6234c982d1e

Download Submit
memory/548-134-0x00000000026C0000-0x0000000002875000-memory.dmp

Filesize
1.7MB

Download
memory/548-135-0x0000000002880000-0x0000000002C50000-memory.dmp

Filesize
3.8MB

Download
memory/548-136-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/548-137-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/548-139-0x00000000026C0000-0x0000000002875000-memory.dmp

Filesize
1.7MB

Download
memory/548-140-0x0000000002880000-0x0000000002C50000-memory.dmp

Filesize
3.8MB

Download
memory/548-141-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/548-147-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-148-0x0000000002350000-0x0000000002509000-memory.dmp

Filesize
1.7MB

Download
memory/1336-149-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-150-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-152-0x0000000002350000-0x0000000002509000-memory.dmp

Filesize
1.7MB

Download
memory/1336-153-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-155-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-156-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-157-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-158-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-160-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1336-161-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download