laplas | 1661daf17ccb995736f0ddb77b1c47be24a3e126816c47764b30b9c82c3a51df

General

Target

4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe
Size

1.8MB
MD5

68732e21f497396296e93fb7277add61
SHA1

1fdec6fc0ab4647491cb163a732d985bf6e75f16
SHA256

4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e
SHA512

b3b2deb42b8c1362642ac725f24a3fc59eade40da1bf5e9f2a66e634ab8f7e3ad75a3eee65003be6532b808ad299ec293a9ceae024217a5de68aa41b61134305
SSDEEP

49152:ZxP1ZMKdnhkmr5VlkA/azDEPKkb89KTYkr3T6:H1v9ViA/wkg9KTZ3T

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2208	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2012	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe
2012	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2208	2012	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe	28
PID 2012 wrote to memory of 2208	2012	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe	28
PID 2012 wrote to memory of 2208	2012	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe	28
PID 2012 wrote to memory of 2208	2012	4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe	28

C:\Users\Admin\AppData\Local\Temp\4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe
"C:\Users\Admin\AppData\Local\Temp\4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
337.7MB

MD5
088c3404b2dbfd53e77de7af7a184531

SHA1
031074eba4c8dc0c537bfdf38ee7ca8199f35df8

SHA256
76523d9c8233b2ed47eb29aeb072bd5f896dd0e4a63c1a6442736b5d85c4c3d7

SHA512
fa631767662cb0cf49c2f4bb9f9e1177f8bbd02f40d25158ba64363cd35e432a58117176f251fe97fc2c29abccc1c8b3485b01cd5469641427a5fac3ac6cb984

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
340.2MB

MD5
e60cb6b605425a4081597d98f404c42b

SHA1
d46b6aa0b1e8eb39396a200d7090fa26c173e894

SHA256
bce38f3ab765b8049329be686652b04b4bab2d06025834c3de882ea8a9780994

SHA512
0c519a5dc0a6eb04bd6c333af4a887d70f29f3dda357648e7b9f91af1435a9356cd430d0eaf7b17e9f82fed0b0cb5f462ff0a51d87c7aa1d780397f3b9d8a704

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
341.1MB

MD5
d411e9b88453993c4ced925ac7979758

SHA1
5918bd49b766cb6b61c1f99160efa1e7faa53db2

SHA256
7ecc4808ab999d6a101bca6446706d0efffc0a4f0b37a7a75884d7ff9cddc345

SHA512
eaab8486a53216f6590459deb03ce7414ed453542066a80d3ba464fc26cbff1c72b744c32fedc889b16812f493de11b0bd742ee1a3d8752b58dfe72d14874687

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
338.9MB

MD5
b303027803b604fa874988438ac1b6db

SHA1
eabe34c21f113ddc28b72a2c204e73eb2d1d4fbc

SHA256
9be26f1cd2a747aacb4b1b71b1b60605cdfd550bdf7a91dbb4c29e33f86ccee5

SHA512
c292f247a236c4d9ef2d06d62bcc90411e5b8064c55097faa50e4713c82d2aa2aa9183fc5a80a3cf62cbcc54823d87a672fc83ec650b43f71b7080dee32f4e7c

Download Submit
memory/2012-71-0x0000000004150000-0x0000000004520000-memory.dmp

Filesize
3.8MB

Download
memory/2012-55-0x0000000003FA0000-0x000000000414A000-memory.dmp

Filesize
1.7MB

Download
memory/2012-56-0x0000000004150000-0x0000000004520000-memory.dmp

Filesize
3.8MB

Download
memory/2012-57-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2012-67-0x0000000003FA0000-0x000000000414A000-memory.dmp

Filesize
1.7MB

Download
memory/2012-66-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2012-54-0x0000000003FA0000-0x000000000414A000-memory.dmp

Filesize
1.7MB

Download
memory/2208-72-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-78-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-70-0x0000000004160000-0x0000000004530000-memory.dmp

Filesize
3.8MB

Download
memory/2208-68-0x0000000003FB0000-0x000000000415A000-memory.dmp

Filesize
1.7MB

Download
memory/2208-73-0x0000000003FB0000-0x000000000415A000-memory.dmp

Filesize
1.7MB

Download
memory/2208-74-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-75-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-76-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-77-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-69-0x0000000003FB0000-0x000000000415A000-memory.dmp

Filesize
1.7MB

Download
memory/2208-79-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-80-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-83-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-84-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-85-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-86-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-87-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-88-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download
memory/2208-89-0x0000000000400000-0x0000000002606000-memory.dmp

Filesize
34.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads