laplas | 4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64

General

Target

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64_JC.exe
Size

1.9MB
MD5

961751858d8b74b2dec9d4f165a0a8c0
SHA1

88ca04fb4d62052614bd9da2b333ab10f5e0bfa7
SHA256

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64
SHA512

c9625844e4acd328977d0078889497e6d8a81025d6d5da787a4ae0b9ee0fa717ee543cd7e520d26f4480265c56c0ea07ae8cecd8518f72afc59d114c605fbe4c
SSDEEP

49152:7YjDgDQj0z0HG2SYE/LA386lYmBk1U5nuyYPcEaC:7YjsEjJ33JYmSa5owC

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2892	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64_JC.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	22	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 2892	700	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64_JC.exe	87
PID 700 wrote to memory of 2892	700	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64_JC.exe	87
PID 700 wrote to memory of 2892	700	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64_JC.exe	87

C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
850.9MB

MD5
37293a2dcb56504fef4f80fde5ca004d

SHA1
cd050bb809675954a3c11035b07a49ce44c2d9ea

SHA256
9fc3791d3ca2e2a2b88f8890310de842001940437553546ec3a3e3b5fa9418ab

SHA512
5633190d267a573a2a004035daf588313cec81e00ef0f54b396d91bde3413b4fcbeb93c0e854b1510609a88e5732cd90fc7565617b70dac0e4d3c5b898107ac4

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
850.9MB

MD5
37293a2dcb56504fef4f80fde5ca004d

SHA1
cd050bb809675954a3c11035b07a49ce44c2d9ea

SHA256
9fc3791d3ca2e2a2b88f8890310de842001940437553546ec3a3e3b5fa9418ab

SHA512
5633190d267a573a2a004035daf588313cec81e00ef0f54b396d91bde3413b4fcbeb93c0e854b1510609a88e5732cd90fc7565617b70dac0e4d3c5b898107ac4

Download Submit
memory/700-133-0x00000000038E0000-0x0000000003A8A000-memory.dmp

Filesize
1.7MB

Download
memory/700-134-0x0000000003A90000-0x0000000003E60000-memory.dmp

Filesize
3.8MB

Download
memory/700-135-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/700-138-0x00000000038E0000-0x0000000003A8A000-memory.dmp

Filesize
1.7MB

Download
memory/700-137-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/700-139-0x0000000003A90000-0x0000000003E60000-memory.dmp

Filesize
3.8MB

Download
memory/700-143-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-148-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-156-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-147-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-144-0x0000000003910000-0x0000000003CE0000-memory.dmp

Filesize
3.8MB

Download
memory/2892-150-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-153-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-155-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-145-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-158-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-160-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-162-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-165-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-167-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-168-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-170-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2892-172-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads