laplas | f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50

General

Target

ec8952a8dcbbfaa1fb6fda23df851402.exe
Size

1.8MB
MD5

ec8952a8dcbbfaa1fb6fda23df851402
SHA1

4fb7a97221090f3a4ff5263103623da165624881
SHA256

f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50
SHA512

33ce0a6ae2929145d75aceee5ab7ca6256c8a630ecb04f8df4addab02541b74c6a350a210cd5426466bf254699b76d8b77259b9bf969a131ca292d9d372d7ffd
SSDEEP

49152:N4o1Bkql93ztp3vKhV2E8rf/L0ZNo2gV6UlAo7TWJ:N4o1Bb73ztVv5Ei0ZTUX7Y

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2192	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1704	ec8952a8dcbbfaa1fb6fda23df851402.exe
1704	ec8952a8dcbbfaa1fb6fda23df851402.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	ec8952a8dcbbfaa1fb6fda23df851402.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2192	1704	ec8952a8dcbbfaa1fb6fda23df851402.exe	28
PID 1704 wrote to memory of 2192	1704	ec8952a8dcbbfaa1fb6fda23df851402.exe	28
PID 1704 wrote to memory of 2192	1704	ec8952a8dcbbfaa1fb6fda23df851402.exe	28
PID 1704 wrote to memory of 2192	1704	ec8952a8dcbbfaa1fb6fda23df851402.exe	28

C:\Users\Admin\AppData\Local\Temp\ec8952a8dcbbfaa1fb6fda23df851402.exe
"C:\Users\Admin\AppData\Local\Temp\ec8952a8dcbbfaa1fb6fda23df851402.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
373.1MB

MD5
5aa51a67b924eded425e095182bb85d7

SHA1
26ebe5356a1973ce712e186680275e3d0a74f01c

SHA256
312a2d47ec13257159eac715e7a33d290a1b91c482d805a880a5e34078449b4f

SHA512
5e6860caee36e99da8eacfe89633d1a7d928b6ac18246836a152f44816711073148aea8d0300c4cc65f304e5946b8b5ea00e94774c2bdbc3656e268a70ea0b2e

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
368.6MB

MD5
0e8646f81c268eb7a1a6b46539df12ed

SHA1
dc45cff19245b65752e13d8f5370f8b5e4c3b14c

SHA256
7b09d5b017f59e95f1fb40ed833b945e45110cbbad72bdc3baf7a13792537b49

SHA512
d700925dcfddc5c60c7331bd22d1bedf1872d020848ba645e4256d859b023b72e85aa3450446415f61fe4c76d7f00ce787c484280e44a640472ea4a41c631045

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
374.2MB

MD5
9cf4f4b8a4b29938bc3e5d08c45cc60a

SHA1
b06255c720572509f78158b25e3e92f28a42ad5d

SHA256
45d44a83495b3d384cf667719142c4054da78833d77b7b4b6b2071019b9ad5fa

SHA512
5fb0a874c2131bb1d05a0d0f6f44fbeeddf377809ef4aa7069d3fa11f951db1bef2c46dea3f7dc6765703fd8e11e687c0c431018160c672549c41182079fa2b1

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
380.1MB

MD5
f7422b07f7e420588a75a9dcf9ff8a0a

SHA1
22e3c67804597062980b8fdca88e4fafe1764329

SHA256
d7f661b9084e49b4ebbae492cc808a6e8257df45eeb3de13c4c8d069367a8305

SHA512
c090f52adb1c4a00765243c412d7a5fc6a90e648502eca1140152cae191dcb2e0b2c2a3ce780c194f73f0232ba633acde4baa0f61a83b2db4c394a0371233eb7

Download Submit
memory/1704-0-0x0000000003E90000-0x000000000403A000-memory.dmp

Filesize
1.7MB

Download
memory/1704-1-0x0000000004040000-0x0000000004410000-memory.dmp

Filesize
3.8MB

Download
memory/1704-2-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/1704-11-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/1704-12-0x0000000004040000-0x0000000004410000-memory.dmp

Filesize
3.8MB

Download
memory/1704-13-0x0000000003E90000-0x000000000403A000-memory.dmp

Filesize
1.7MB

Download
memory/2192-16-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-21-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-14-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-17-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-18-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-19-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-20-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-15-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-24-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-25-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-26-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-27-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-28-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-29-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2192-30-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads