laplas | e522454c7fb915cb65e42e67ea9890df5ead1356053e563c43a1603f669c6fa2

Analysis

max time kernel
300s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2023 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lang.exe
Size

3.9MB
MD5

2aa0fe002aeee888c33dbb6864580e6c
SHA1

e10a14cede8f2e48ccd6fb5111583fcf5156030a
SHA256

e522454c7fb915cb65e42e67ea9890df5ead1356053e563c43a1603f669c6fa2
SHA512

0598092827b729fa9720f4fbd61087323fce6fb7318fb286784fcc125c5e64d69a0d9cdb57ee11ca0f7474dffd17b7af647ef71affafdb0fc608b705bd66d1fd
SSDEEP

98304:LdD7hTCd16KI1cqLrUmolDD/0z+lzZQ57j:LJ7F4wcYUdRzI7j

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.209.161.89

Attributes

api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2232	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	Lang.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1452	Lang.exe
2232	ntlhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	33	Go-http-client/1.1

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2232	1452	Lang.exe	86
PID 1452 wrote to memory of 2232	1452	Lang.exe	86

C:\Users\Admin\AppData\Local\Temp\Lang.exe
"C:\Users\Admin\AppData\Local\Temp\Lang.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
828.9MB

MD5
019edd6fea9ab58d35a53dcfe4115f5c

SHA1
d839a20cd24b248302d708e88d37033c23e8961e

SHA256
d05917fe1da49f7368b1f773e8c36e3f2fe849c39555c214ee1f6db292231e6a

SHA512
585f20c21bbe2b7fe4a6e494af63e257d4c02eddfdfc4aef9320accf4d7f6dc629965ba52a060fc4b02803971277ed238f55d79d28be0575db858769ca41e6cf

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
828.9MB

MD5
019edd6fea9ab58d35a53dcfe4115f5c

SHA1
d839a20cd24b248302d708e88d37033c23e8961e

SHA256
d05917fe1da49f7368b1f773e8c36e3f2fe849c39555c214ee1f6db292231e6a

SHA512
585f20c21bbe2b7fe4a6e494af63e257d4c02eddfdfc4aef9320accf4d7f6dc629965ba52a060fc4b02803971277ed238f55d79d28be0575db858769ca41e6cf

Download Submit
memory/1452-133-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-134-0x00007FFF496F0000-0x00007FFF498E5000-memory.dmp

Filesize
2.0MB

Download
memory/1452-135-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-136-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-137-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-138-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-139-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-140-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-141-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-142-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-143-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-144-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-146-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-147-0x00007FFF496F0000-0x00007FFF498E5000-memory.dmp

Filesize
2.0MB

Download
memory/1452-150-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-152-0x0000000000BA0000-0x00000000014C9000-memory.dmp

Filesize
9.2MB

Download
memory/1452-153-0x00007FFF496F0000-0x00007FFF498E5000-memory.dmp

Filesize
2.0MB

Download
memory/2232-154-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-155-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-156-0x00007FFF496F0000-0x00007FFF498E5000-memory.dmp

Filesize
2.0MB

Download
memory/2232-157-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-158-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-159-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-160-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-161-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-162-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-163-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-164-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-165-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-166-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-167-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-168-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-169-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-170-0x00007FFF496F0000-0x00007FFF498E5000-memory.dmp

Filesize
2.0MB

Download
memory/2232-171-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-172-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-174-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-175-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-176-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-177-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-178-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-179-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-180-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-181-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-182-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-183-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-184-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-185-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-186-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-187-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-188-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-189-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-190-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-191-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-192-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-193-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-194-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-195-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-196-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-197-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download
memory/2232-198-0x0000000000C70000-0x0000000001599000-memory.dmp

Filesize
9.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads