laplas | 346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c

Analysis

max time kernel
291s
max time network
262s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
05-08-2023 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe
Size

4.4MB
MD5

f61e05f96863f1070d3614d2dd6cb4f7
SHA1

43aea9068eed04aa2aa44e352e69a5ba9cecc6c7
SHA256

346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c
SHA512

61477452f661cc0835f3806ee93f5c42057b57a4505dbb6f1f739935c875857f12fb5d48c385e4b8473a075dfd1684bdb695cd0ef3c376e9a6a808fde7df25dc
SSDEEP

98304:ZBGu/ztzM5DBhXBXrkUULWWd7PrTgvvQ069Rmu/sKWBGJx:ZB3/V+DBhXVkUULbPcY35/sKWm

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.159.189.33

Attributes

api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
3584	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1528	346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe
3584	ntlhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3584	1528	346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe	70
PID 1528 wrote to memory of 3584	1528	346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe	70

C:\Users\Admin\AppData\Local\Temp\346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe
"C:\Users\Admin\AppData\Local\Temp\346c907673f63b007141f403f6ae9b888103132b75a1ab056e5898917f8ab28c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
769.4MB

MD5
6f389d18945476306782404ca50343ba

SHA1
badded01b305295abee0df7fec55609c768588e4

SHA256
21aafa4ef382b4379dbb3f506073b360f380119899af4b901afc41684ef995bb

SHA512
b6a8d385c90cf2fab2bd93f8d7f9b5d80ba0808763c89706d5eefdfac5c847c8e25f32690c1d220bc5133f38000c9be8a64aeb2874986424b0cad81d184ab6ca

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
769.4MB

MD5
6f389d18945476306782404ca50343ba

SHA1
badded01b305295abee0df7fec55609c768588e4

SHA256
21aafa4ef382b4379dbb3f506073b360f380119899af4b901afc41684ef995bb

SHA512
b6a8d385c90cf2fab2bd93f8d7f9b5d80ba0808763c89706d5eefdfac5c847c8e25f32690c1d220bc5133f38000c9be8a64aeb2874986424b0cad81d184ab6ca

Download Submit
memory/1528-127-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-128-0x00007FFE3FE30000-0x00007FFE4000B000-memory.dmp

Filesize
1.9MB

Download
memory/1528-121-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-122-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-123-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-124-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-125-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-126-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-117-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-120-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-130-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-131-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-132-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-133-0x00007FFE3FE30000-0x00007FFE4000B000-memory.dmp

Filesize
1.9MB

Download
memory/1528-119-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-136-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-118-0x00000000011E0000-0x0000000001ACE000-memory.dmp

Filesize
8.9MB

Download
memory/1528-139-0x00007FFE3FE30000-0x00007FFE4000B000-memory.dmp

Filesize
1.9MB

Download
memory/3584-150-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-162-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-141-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-142-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-144-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-143-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-146-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-147-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-148-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-149-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-138-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-151-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-152-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-153-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-154-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-155-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-156-0x00007FFE3FE30000-0x00007FFE4000B000-memory.dmp

Filesize
1.9MB

Download
memory/3584-157-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-159-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-160-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-161-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-140-0x00007FFE3FE30000-0x00007FFE4000B000-memory.dmp

Filesize
1.9MB

Download
memory/3584-163-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-164-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-165-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-166-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-167-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-168-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-169-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-170-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-171-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-172-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-173-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-174-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-175-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-176-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-177-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-178-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-179-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-180-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-181-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download
memory/3584-182-0x0000000000F70000-0x000000000185E000-memory.dmp

Filesize
8.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads