laplas | 22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9

General

Target

22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe
Size

3.0MB
MD5

02208e4168793ef72942aa31c1ae8642
SHA1

449b579d0b642ca43419c0687cc799afe5aa9194
SHA256

22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9
SHA512

f50be51f1ff3da3da34d4c819021686842d024476993031e56313fde1aded427e9e81d0cb2956c98d29839fac140597a8e1b1cbd89a58c481be70ce88ce5507f
SSDEEP

49152:MY5UqJTec/w5ashu/usRTe2WjCJILmGsO8ASotjEH10DwJ4mQDewL11TAjZVwyb:MYUqI5aPXZJIpsr7VrJ4zDHL11byb

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes

api_key
f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

2992 ntlhost.exe

pid	process
2992	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exentlhost.exe

pid process

3108 22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe
2992 ntlhost.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 16 Go-http-client/1.1

pid	process
3108	22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe
2992	ntlhost.exe

description	flow	ioc
HTTP User-Agent header	16	Go-http-client/1.1

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe

description	pid	process	target process
PID 3108 wrote to memory of 2992	3108	22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe	ntlhost.exe
PID 3108 wrote to memory of 2992	3108	22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe
"C:\Users\Admin\AppData\Local\Temp\22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3108

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
737.0MB

MD5
f59cfda61a55ff49e4c2bca9976e9db6

SHA1
7cd6e4332330c424a9e1a20d8d741f0cf61613cc

SHA256
c38339b7a4e9d1fede0dbe3c4e703380ca4eaec0e8c3340d81ec5eadbaa59121

SHA512
9de02a034a7018e2956e499d7ca398eff797f5b530e998160a33a01f3cab09dcf5bde6ce2a817e5204c89c990161738a9730cc51d916d07da5aebb4484f67073

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
737.0MB

MD5
f59cfda61a55ff49e4c2bca9976e9db6

SHA1
7cd6e4332330c424a9e1a20d8d741f0cf61613cc

SHA256
c38339b7a4e9d1fede0dbe3c4e703380ca4eaec0e8c3340d81ec5eadbaa59121

SHA512
9de02a034a7018e2956e499d7ca398eff797f5b530e998160a33a01f3cab09dcf5bde6ce2a817e5204c89c990161738a9730cc51d916d07da5aebb4484f67073

Download Submit
memory/2992-181-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-182-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/2992-165-0x00007FFD80000000-0x00007FFD80002000-memory.dmp

Filesize
8KB

Download
memory/2992-196-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-166-0x00007FFD80030000-0x00007FFD80031000-memory.dmp

Filesize
4KB

Download
memory/2992-195-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-194-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-193-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-192-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-191-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-190-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-189-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-188-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-187-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-186-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-184-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-183-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-170-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-180-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-179-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-178-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-177-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-174-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-161-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-167-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/2992-175-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-163-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/2992-164-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/2992-173-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-171-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-172-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/2992-168-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-169-0x0000000000AC0000-0x00000000013DD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-151-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-162-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/3108-140-0x00007FFD80000000-0x00007FFD80002000-memory.dmp

Filesize
8KB

Download
memory/3108-137-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/3108-160-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

Filesize
2.0MB

Download
memory/3108-134-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/3108-158-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-135-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/3108-155-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

Filesize
2.0MB

Download
memory/3108-154-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/3108-133-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-153-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-152-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/3108-136-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

Filesize
2.8MB

Download
memory/3108-149-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-148-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-147-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-146-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-145-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-144-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-143-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-142-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-141-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

Filesize
2.0MB

Download
memory/3108-139-0x0000000000590000-0x0000000000EAD000-memory.dmp

Filesize
9.1MB

Download
memory/3108-138-0x00007FFD80030000-0x00007FFD80031000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads