laplas | 4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64

General

Target

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe
Size

1.9MB
MD5

961751858d8b74b2dec9d4f165a0a8c0
SHA1

88ca04fb4d62052614bd9da2b333ab10f5e0bfa7
SHA256

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64
SHA512

c9625844e4acd328977d0078889497e6d8a81025d6d5da787a4ae0b9ee0fa717ee543cd7e520d26f4480265c56c0ea07ae8cecd8518f72afc59d114c605fbe4c
SSDEEP

49152:7YjDgDQj0z0HG2SYE/LA386lYmBk1U5nuyYPcEaC:7YjsEjJ33JYmSa5owC

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
4748	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4175128012-676912335-1083716439-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4748	4908	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	69
PID 4908 wrote to memory of 4748	4908	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	69
PID 4908 wrote to memory of 4748	4908	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	69

C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe
"C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
712.9MB

MD5
f97784b70cb18699e6a7e655065e2c01

SHA1
91663137e0222327ac33141938f00a5fb2c7ec86

SHA256
71dfe69a4ea2dbebb73639b42cb3c10bfbbb6b24dbdd0460771bce21c93de0a2

SHA512
cd33475996efb054c5fe5a651ebfdb2b87497500e3c0035bb9925ef493c9156c07b53771ff23cba79fcc5826693c0509dd4921f8bb309c2def32d314ed7027f1

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
712.9MB

MD5
f97784b70cb18699e6a7e655065e2c01

SHA1
91663137e0222327ac33141938f00a5fb2c7ec86

SHA256
71dfe69a4ea2dbebb73639b42cb3c10bfbbb6b24dbdd0460771bce21c93de0a2

SHA512
cd33475996efb054c5fe5a651ebfdb2b87497500e3c0035bb9925ef493c9156c07b53771ff23cba79fcc5826693c0509dd4921f8bb309c2def32d314ed7027f1

Download Submit
memory/4748-136-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-139-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-143-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-142-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-141-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-140-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-138-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-129-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-130-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-131-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-132-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-133-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-135-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4748-137-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4908-117-0x00000000036B0000-0x000000000385A000-memory.dmp

Filesize
1.7MB

Download
memory/4908-127-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4908-121-0x00000000036B0000-0x000000000385A000-memory.dmp

Filesize
1.7MB

Download
memory/4908-118-0x0000000003860000-0x0000000003C30000-memory.dmp

Filesize
3.8MB

Download
memory/4908-119-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4908-123-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/4908-122-0x0000000003860000-0x0000000003C30000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads