laplas | f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec8952a8dcbbfaa1fb6fda23df851402.exe
Size

1.8MB
MD5

ec8952a8dcbbfaa1fb6fda23df851402
SHA1

4fb7a97221090f3a4ff5263103623da165624881
SHA256

f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50
SHA512

33ce0a6ae2929145d75aceee5ab7ca6256c8a630ecb04f8df4addab02541b74c6a350a210cd5426466bf254699b76d8b77259b9bf969a131ca292d9d372d7ffd
SSDEEP

49152:N4o1Bkql93ztp3vKhV2E8rf/L0ZNo2gV6UlAo7TWJ:N4o1Bb73ztVv5Ei0ZTUX7Y

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Executes dropped EXE 1 IoCs

Processes:

ntlhost.exe

pid process

3896 ntlhost.exe

pid	process
3896	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ec8952a8dcbbfaa1fb6fda23df851402.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	ec8952a8dcbbfaa1fb6fda23df851402.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ec8952a8dcbbfaa1fb6fda23df851402.exe

description	pid	process	target process
PID 8 wrote to memory of 3896	8	ec8952a8dcbbfaa1fb6fda23df851402.exe	ntlhost.exe
PID 8 wrote to memory of 3896	8	ec8952a8dcbbfaa1fb6fda23df851402.exe	ntlhost.exe
PID 8 wrote to memory of 3896	8	ec8952a8dcbbfaa1fb6fda23df851402.exe	ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\ec8952a8dcbbfaa1fb6fda23df851402.exe
"C:\Users\Admin\AppData\Local\Temp\ec8952a8dcbbfaa1fb6fda23df851402.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:8

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
2⤵
- Executes dropped EXE
PID:3896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
76.9MB

MD5
152eb5e7bd1db4fe4fa38183ad823886

SHA1
7c01a7dc7156486dd8eb77126697fd2d566ee4ed

SHA256
d4c82d7b97749c67ab12e5dc34b54dd05f20b6042b8118fb60ea5a1c244e3ba3

SHA512
5b03154fd01fa82cb27245c9f28319e3f62d3a2e77d7f93d97fc8ab10b3212b7e459d90aa23c4b31c1c130489691055e5b4ac5fec705fa2c08c358b5b50cc07d

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Filesize
71.9MB

MD5
6fa00941179c2003f51dd760e8194f59

SHA1
c90d8cec63d51c7c928a03306ee437535b7ca795

SHA256
446edde72813cd70a73b59b1fed6db3ed889fa5b951dd2ffa4a679238c9e2c5f

SHA512
7bc6cdd36ee4e326447b7165858ac5831d9bd5f25ba4ae37ed6d58eebe9bd56c0c8d87fb077bb335607643a2b679bd3fe1aad883613885be62e68e7c658c77db

Download Submit
memory/8-0-0x00000000043B0000-0x000000000455A000-memory.dmp

Filesize
1.7MB

Download
memory/8-1-0x00000000045A0000-0x0000000004970000-memory.dmp

Filesize
3.8MB

Download
memory/8-2-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/8-4-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/8-5-0x00000000043B0000-0x000000000455A000-memory.dmp

Filesize
1.7MB

Download
memory/8-6-0x00000000045A0000-0x0000000004970000-memory.dmp

Filesize
3.8MB

Download
memory/8-9-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-12-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-11-0x0000000004320000-0x00000000044CA000-memory.dmp

Filesize
1.7MB

Download
memory/3896-13-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-16-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-17-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-18-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-20-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-21-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-23-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-24-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-25-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-26-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3896-27-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download