laplas | 4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e

General

Target

68732e21f497396296e93fb7277add61.bin.exe
Size

1.8MB
MD5

68732e21f497396296e93fb7277add61
SHA1

1fdec6fc0ab4647491cb163a732d985bf6e75f16
SHA256

4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e
SHA512

b3b2deb42b8c1362642ac725f24a3fc59eade40da1bf5e9f2a66e634ab8f7e3ad75a3eee65003be6532b808ad299ec293a9ceae024217a5de68aa41b61134305
SSDEEP

49152:ZxP1ZMKdnhkmr5VlkA/azDEPKkb89KTYkr3T6:H1v9ViA/wkg9KTZ3T

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
3268	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	68732e21f497396296e93fb7277add61.bin.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	23	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3268	3588	68732e21f497396296e93fb7277add61.bin.exe	85
PID 3588 wrote to memory of 3268	3588	68732e21f497396296e93fb7277add61.bin.exe	85
PID 3588 wrote to memory of 3268	3588	68732e21f497396296e93fb7277add61.bin.exe	85

C:\Users\Admin\AppData\Local\Temp\68732e21f497396296e93fb7277add61.bin.exe
"C:\Users\Admin\AppData\Local\Temp\68732e21f497396296e93fb7277add61.bin.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
714.8MB

MD5
96f7317988d038b2f2c8862a3f05fc04

SHA1
4c675e9a5b00846e2435c8ee7f61f092f100dd9d

SHA256
e071a7b1e8015b55ef688382a7f8b418923a88a0a04799bbdbb2bd8902ccf9b9

SHA512
841f2b5b8f1e4c977608207b2b75829ca95f450024e25f2cd1b3152cfe4cd0e88e46e65511dd3a40b31124742969c8125843955e78505eb786250da20c08d3ba

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
714.8MB

MD5
96f7317988d038b2f2c8862a3f05fc04

SHA1
4c675e9a5b00846e2435c8ee7f61f092f100dd9d

SHA256
e071a7b1e8015b55ef688382a7f8b418923a88a0a04799bbdbb2bd8902ccf9b9

SHA512
841f2b5b8f1e4c977608207b2b75829ca95f450024e25f2cd1b3152cfe4cd0e88e46e65511dd3a40b31124742969c8125843955e78505eb786250da20c08d3ba

Download Submit
memory/3268-149-0x0000000004370000-0x000000000451D000-memory.dmp

Filesize
1.7MB

Download
memory/3268-156-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-150-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-161-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-160-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-159-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-158-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-146-0x0000000004370000-0x000000000451D000-memory.dmp

Filesize
1.7MB

Download
memory/3268-147-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-152-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-157-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-162-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-148-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-153-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-154-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3268-155-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3588-138-0x0000000004370000-0x0000000004521000-memory.dmp

Filesize
1.7MB

Download
memory/3588-139-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3588-144-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3588-135-0x0000000004530000-0x0000000004900000-memory.dmp

Filesize
3.8MB

Download
memory/3588-136-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/3588-140-0x0000000004530000-0x0000000004900000-memory.dmp

Filesize
3.8MB

Download
memory/3588-134-0x0000000004370000-0x0000000004521000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads