Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2023 23:24

General

  • Target

    22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe

  • Size

    3.0MB

  • MD5

    02208e4168793ef72942aa31c1ae8642

  • SHA1

    449b579d0b642ca43419c0687cc799afe5aa9194

  • SHA256

    22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9

  • SHA512

    f50be51f1ff3da3da34d4c819021686842d024476993031e56313fde1aded427e9e81d0cb2956c98d29839fac140597a8e1b1cbd89a58c481be70ce88ce5507f

  • SSDEEP

    49152:MY5UqJTec/w5ashu/usRTe2WjCJILmGsO8ASotjEH10DwJ4mQDewL11TAjZVwyb:MYUqI5aPXZJIpsr7VrJ4zDHL11byb

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe
    "C:\Users\Admin\AppData\Local\Temp\22b198c5fc1e073ef00fc7a44ca20db5f44630f4e0e746abcf2060207d7129d9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:3108
    • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    737.0MB

    MD5

    f59cfda61a55ff49e4c2bca9976e9db6

    SHA1

    7cd6e4332330c424a9e1a20d8d741f0cf61613cc

    SHA256

    c38339b7a4e9d1fede0dbe3c4e703380ca4eaec0e8c3340d81ec5eadbaa59121

    SHA512

    9de02a034a7018e2956e499d7ca398eff797f5b530e998160a33a01f3cab09dcf5bde6ce2a817e5204c89c990161738a9730cc51d916d07da5aebb4484f67073

  • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

    Filesize

    737.0MB

    MD5

    f59cfda61a55ff49e4c2bca9976e9db6

    SHA1

    7cd6e4332330c424a9e1a20d8d741f0cf61613cc

    SHA256

    c38339b7a4e9d1fede0dbe3c4e703380ca4eaec0e8c3340d81ec5eadbaa59121

    SHA512

    9de02a034a7018e2956e499d7ca398eff797f5b530e998160a33a01f3cab09dcf5bde6ce2a817e5204c89c990161738a9730cc51d916d07da5aebb4484f67073

  • memory/2992-181-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-182-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/2992-165-0x00007FFD80000000-0x00007FFD80002000-memory.dmp

    Filesize

    8KB

  • memory/2992-196-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-166-0x00007FFD80030000-0x00007FFD80031000-memory.dmp

    Filesize

    4KB

  • memory/2992-195-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-194-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-193-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-192-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-191-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-190-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-189-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-188-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-187-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-186-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-184-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2992-183-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-170-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-180-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-179-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-178-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-177-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-174-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-161-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-167-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/2992-175-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-163-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/2992-164-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/2992-173-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-171-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-172-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/2992-168-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2992-169-0x0000000000AC0000-0x00000000013DD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-151-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-162-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/3108-140-0x00007FFD80000000-0x00007FFD80002000-memory.dmp

    Filesize

    8KB

  • memory/3108-137-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/3108-160-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3108-134-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/3108-158-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-135-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/3108-155-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3108-154-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/3108-133-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-153-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-152-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/3108-136-0x00007FFDB9B70000-0x00007FFDB9E39000-memory.dmp

    Filesize

    2.8MB

  • memory/3108-149-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-148-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-147-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-146-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-145-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-144-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-143-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-142-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-141-0x00007FFDBBFB0000-0x00007FFDBC1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3108-139-0x0000000000590000-0x0000000000EAD000-memory.dmp

    Filesize

    9.1MB

  • memory/3108-138-0x00007FFD80030000-0x00007FFD80031000-memory.dmp

    Filesize

    4KB