laplas | 836844a9b401f82d1c13a5f96fa3b069ab5192f495bee7ca8e29c154ae265b24

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-08-2023 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a38087ca29b3ad34f4bdc30621c409.exe
Size

4.0MB
MD5

35a38087ca29b3ad34f4bdc30621c409
SHA1

444b346f51169737596b497aac18a9d536b229ce
SHA256

836844a9b401f82d1c13a5f96fa3b069ab5192f495bee7ca8e29c154ae265b24
SHA512

71ba2ad10bba8cd31480170d05c1e9b32c48280bfe50abc4348bffab51cbc1d919ae53d65fc058b81f3c6fad4c45a45302c6bdae7ce4716ef3a075a86c4b7969
SSDEEP

49152:oEjwvlIKv05z+UERnIcYmWjc3CdhT5E9UFiqeb0/B1:elhWzZ6hCEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://206.189.229.43

Attributes

api_key
f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1908	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2124	35a38087ca29b3ad34f4bdc30621c409.exe
2124	35a38087ca29b3ad34f4bdc30621c409.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	35a38087ca29b3ad34f4bdc30621c409.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1908	2124	35a38087ca29b3ad34f4bdc30621c409.exe	28
PID 2124 wrote to memory of 1908	2124	35a38087ca29b3ad34f4bdc30621c409.exe	28
PID 2124 wrote to memory of 1908	2124	35a38087ca29b3ad34f4bdc30621c409.exe	28

C:\Users\Admin\AppData\Local\Temp\35a38087ca29b3ad34f4bdc30621c409.exe
"C:\Users\Admin\AppData\Local\Temp\35a38087ca29b3ad34f4bdc30621c409.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
651.9MB

MD5
00146993f5633f83bbc4ac5600569001

SHA1
44bf007fd24c950cc920447eb16d3f72fa8499b2

SHA256
0004397ff7078b37b58b074dbbf013c1cbc5e2a489cbc88366c5bf8f8e7fa7a9

SHA512
fd0d0928fe15c56d42b22ea88ffa7e2c38390923daeedf5df692205c0a747e920f926d41afe4d286511b1d904768ddc30ea56d3eb7a4d3dc32ce6cdbe5b0701a

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
649.3MB

MD5
d490fc3201d5240ae3ab2c6a444a84e5

SHA1
beaef56a98213a236f2f748829dee1fe3262afb2

SHA256
dfc9c1a61a2a847eeaa834ff1541c49424ac4948e0bc0aeb50cf309544af8628

SHA512
748f3241592cac755ce3a3f3561ef77d854de15397ba71553c3eed00247f40976be3fc1c757c2a0360a41a29dc5cb263b3fafc1749647bb5f582d05748b01a76

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
642.0MB

MD5
521a728d0be8720d86741998e8b1aa48

SHA1
6ed31015ea59effcf1e36a233c15e1f28145ac70

SHA256
6763183e2c378e337ee28808342922700b708e43a4f5b09ab46514af3fde9a5b

SHA512
c53f10bb117b23927b98c19dc112a42fb574c3e9d3e4ad7254bda144862f2c549eabcf55802e0f6cfdb75eec1253262373372c8d8b01abf6476f0267284dcb46

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads