laplas | 4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e

General

Target

4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e_JC.exe
Size

1.8MB
MD5

68732e21f497396296e93fb7277add61
SHA1

1fdec6fc0ab4647491cb163a732d985bf6e75f16
SHA256

4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e
SHA512

b3b2deb42b8c1362642ac725f24a3fc59eade40da1bf5e9f2a66e634ab8f7e3ad75a3eee65003be6532b808ad299ec293a9ceae024217a5de68aa41b61134305
SSDEEP

49152:ZxP1ZMKdnhkmr5VlkA/azDEPKkb89KTYkr3T6:H1v9ViA/wkg9KTZ3T

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
452	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e_JC.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	33	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 452	1372	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e_JC.exe	86
PID 1372 wrote to memory of 452	1372	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e_JC.exe	86
PID 1372 wrote to memory of 452	1372	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
195.7MB

MD5
5826e776a96f59f6ab7b28f326402950

SHA1
1ea23924918d15d4b5cd2c6bd6df75b3f1759fb8

SHA256
4f808c43ce2df5591c320c9b816813e2dce0660084cb335fe025f0595f67b405

SHA512
4bac3725f2fa3eb23d63867da04d252640aea06b1737b134d63267483f6b2428342ce0814a7ba0c5f4f6dc696ee0e46832db831941f4a64ad306af2ed81fb520

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
205.2MB

MD5
f7f951ac57531d5e6e9b87c77b14b168

SHA1
714a0d6a6ff58e4897a957d85ed0b64c200a9cdf

SHA256
052108d6c322aa506f17938d15759873404ecada443db07a62e488fd75474fc8

SHA512
4eaf602f32d3b1b111ac5998c58ac19cff939e1aac2e9a97a9673b7656035e80a270725c3eafed16189077c3e72735bd993ecc9433571ebc589c9e1d087abca7

Download Submit
memory/452-159-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-149-0x0000000004370000-0x0000000004526000-memory.dmp

Filesize
1.7MB

Download
memory/452-153-0x0000000004370000-0x0000000004526000-memory.dmp

Filesize
1.7MB

Download
memory/452-154-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-152-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-165-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-164-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-163-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-162-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-157-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-150-0x0000000004530000-0x0000000004900000-memory.dmp

Filesize
3.8MB

Download
memory/452-151-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-166-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-161-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-158-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-155-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/452-156-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/1372-138-0x0000000004440000-0x00000000045F1000-memory.dmp

Filesize
1.7MB

Download
memory/1372-139-0x0000000004600000-0x00000000049D0000-memory.dmp

Filesize
3.8MB

Download
memory/1372-134-0x0000000004440000-0x00000000045F1000-memory.dmp

Filesize
1.7MB

Download
memory/1372-137-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/1372-146-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/1372-135-0x0000000004600000-0x00000000049D0000-memory.dmp

Filesize
3.8MB

Download
memory/1372-136-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/1372-142-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/1372-140-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads