laplas | f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50.exe
Size

1.8MB
MD5

ec8952a8dcbbfaa1fb6fda23df851402
SHA1

4fb7a97221090f3a4ff5263103623da165624881
SHA256

f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50
SHA512

33ce0a6ae2929145d75aceee5ab7ca6256c8a630ecb04f8df4addab02541b74c6a350a210cd5426466bf254699b76d8b77259b9bf969a131ca292d9d372d7ffd
SSDEEP

49152:N4o1Bkql93ztp3vKhV2E8rf/L0ZNo2gV6UlAo7TWJ:N4o1Bb73ztVv5Ei0ZTUX7Y

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
3420	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 3420	2644	f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50.exe	86
PID 2644 wrote to memory of 3420	2644	f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50.exe	86
PID 2644 wrote to memory of 3420	2644	f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50.exe	86

C:\Users\Admin\AppData\Local\Temp\f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50.exe
"C:\Users\Admin\AppData\Local\Temp\f022037056b50b4baf5db8ba0a437494662dc93cee9421ed12471e14a58a0d50.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
89.9MB

MD5
10ebb89c5a4acf394d8901db48671143

SHA1
b3d455812f534e1e5e80b50380c78b9d40baae13

SHA256
68826963909b671f944de37df8b3bb04c53f626c4a892302b0cac147e583d9bd

SHA512
bdf32acac2025d841c4b701fed26a17edfc2edfade422c513e1269d7a09c59250d122ed9c51fcd2168eab321c75ca06585a3ef23183393919e7364d9dfd38fcd

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
91.2MB

MD5
9c5c0d1c4279afa1037308be43c02db7

SHA1
cc0044dfbf877d92be8d531ad5043a5c8c7eb410

SHA256
1cceba6e0617a712aff09cc323d3cfecc8c80db0c6be8acb04becf9d24d0b912

SHA512
a1613ea819feefbac335291966cc6597e1e70cf6acfdeab5641478af59f96a731a8f8e50ea5583aaafbd4cb661038db9506af1662496d6ccdbbb5ceea89e4ca5

Download Submit
memory/2644-0-0x00000000044F0000-0x000000000469A000-memory.dmp

Filesize
1.7MB

Download
memory/2644-1-0x00000000046A0000-0x0000000004A70000-memory.dmp

Filesize
3.8MB

Download
memory/2644-2-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2644-4-0x00000000044F0000-0x000000000469A000-memory.dmp

Filesize
1.7MB

Download
memory/2644-5-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/2644-6-0x00000000046A0000-0x0000000004A70000-memory.dmp

Filesize
3.8MB

Download
memory/2644-9-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-12-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-11-0x0000000004250000-0x00000000043FA000-memory.dmp

Filesize
1.7MB

Download
memory/3420-13-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-15-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-16-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-17-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-18-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-20-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-22-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-23-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-24-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-25-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3420-26-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads