laplas | fa3cd18198b639bed6d19f3ecbb4cc3d3b834c6926066caac9e0acb2003cd1fe

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe
Size

9.7MB
MD5

26dbb8cdc46ecf186fe07605207bf622
SHA1

916e3e9f55205fbd45ec1fbb47db370d4f668d18
SHA256

badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98
SHA512

f20a3f64747f61b4b8aebc04309ebd2b6490ec0c8d0d4a974a2ccbe730ec89681e1bfcf80c054efd6e49cc1931feac31859a3c0a3795c6ae7c8a90a0d1e7743f
SSDEEP

98304:zvw0Hotqx1pWuJ56DdIPqDyj/pCu03o8I6v+5/QGJbY9YAq+6FLiX:zY0Hotqx1EA56hLnr48IH/HK186

Score

10^/10

laplas clipper stealer themida

Malware Config

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2704	edgeTaskUpdater.exe

Loads dropped DLL 1 IoCs

pid	Process
2764	taskeng.exe

Themida packer 15 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/484-2-0x000000013FCA0000-0x000000014065B000-memory.dmp	themida
behavioral1/memory/484-1-0x000000013FCA0000-0x000000014065B000-memory.dmp	themida
behavioral1/memory/484-0-0x000000013FCA0000-0x000000014065B000-memory.dmp	themida
behavioral1/memory/484-3-0x000000013FCA0000-0x000000014065B000-memory.dmp	themida
behavioral1/memory/484-4-0x000000013FCA0000-0x000000014065B000-memory.dmp	themida
behavioral1/memory/484-7-0x000000013FCA0000-0x000000014065B000-memory.dmp	themida
behavioral1/memory/484-12-0x000000013FCA0000-0x000000014065B000-memory.dmp	themida
behavioral1/files/0x00080000000120c8-13.dat	themida
behavioral1/files/0x00080000000120c8-16.dat	themida
behavioral1/memory/2704-17-0x000000013FC90000-0x000000014064B000-memory.dmp	themida
behavioral1/memory/2704-18-0x000000013FC90000-0x000000014064B000-memory.dmp	themida
behavioral1/memory/2704-19-0x000000013FC90000-0x000000014064B000-memory.dmp	themida
behavioral1/memory/2704-21-0x000000013FC90000-0x000000014064B000-memory.dmp	themida
behavioral1/memory/2704-22-0x000000013FC90000-0x000000014064B000-memory.dmp	themida
behavioral1/memory/2704-45-0x000000013FC90000-0x000000014064B000-memory.dmp	themida

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2704	edgeTaskUpdater.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1128	484	badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe	31
PID 484 wrote to memory of 1128	484	badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe	31
PID 484 wrote to memory of 1128	484	badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe	31
PID 2764 wrote to memory of 2704	2764	taskeng.exe	34
PID 2764 wrote to memory of 2704	2764	taskeng.exe	34
PID 2764 wrote to memory of 2704	2764	taskeng.exe	34
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36
PID 2704 wrote to memory of 2980	2704	edgeTaskUpdater.exe	36

C:\Users\Admin\AppData\Local\Temp\badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe
"C:\Users\Admin\AppData\Local\Temp\badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "EdgeUpdater-Task" /TR "C:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe" /SC MINUTE
  2⤵
  - Creates scheduled task(s)
  PID:1128

C:\Windows\system32\taskeng.exe
taskeng.exe {841950E6-5D21-4CA3-AB7B-BB18775163D6} S-1-5-21-1528014236-771305907-3973026625-1000:DMCOTBQQ\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764
- C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exe
  C:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
    3⤵
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exe

Filesize
98.1MB

MD5
81f493fc81dcc1b6b3079b85a767ccdb

SHA1
a98e20b30e7ca70eec1764815b2cc8e2b164c5b5

SHA256
a3abf64820c842687ca370d0bd5fc2d409801ccf16b2fa24404cc3bb72033727

SHA512
4b5cb7194754d8721335bd03795d349171a9de3a1a5e45c5fb55c4a15285f1a620cdc7a265ecdf7620b3e6192c5f4835aadfb5456c3e998c9319defbe1d1d033

Download Submit
\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exe

Filesize
123.2MB

MD5
1a66e2942db35df64e39ee726b512cdc

SHA1
a44ad5a3668d4691043f068ce30093ced662fdcc

SHA256
504d93ca3ba5affa0f462a4dcb9646f2f2a20a6e204e77fe795f8600d4c82fb7

SHA512
d369844e0254d1a7e18c56fe65aa0608060277ba3ce6ab294dd16a22eb81de6fd8288ad1d817faf581a107057faca458241e69347950dedfbf066b9100f02939

Download Submit
memory/484-2-0x000000013FCA0000-0x000000014065B000-memory.dmp

Filesize
9.7MB

Download
memory/484-1-0x000000013FCA0000-0x000000014065B000-memory.dmp

Filesize
9.7MB

Download
memory/484-0-0x000000013FCA0000-0x000000014065B000-memory.dmp

Filesize
9.7MB

Download
memory/484-3-0x000000013FCA0000-0x000000014065B000-memory.dmp

Filesize
9.7MB

Download
memory/484-4-0x000000013FCA0000-0x000000014065B000-memory.dmp

Filesize
9.7MB

Download
memory/484-7-0x000000013FCA0000-0x000000014065B000-memory.dmp

Filesize
9.7MB

Download
memory/484-12-0x000000013FCA0000-0x000000014065B000-memory.dmp

Filesize
9.7MB

Download
memory/2704-17-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2704-18-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2704-19-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2704-21-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2704-22-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2704-45-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2764-15-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2764-20-0x000000013FC90000-0x000000014064B000-memory.dmp

Filesize
9.7MB

Download
memory/2980-42-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-51-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-25-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-26-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-28-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-30-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-32-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-34-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-35-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-36-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-37-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-38-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-40-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-41-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-39-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-23-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-43-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-44-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-46-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-47-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-48-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-49-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-50-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-24-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-52-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-53-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-54-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-55-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-56-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-57-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-58-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-59-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-60-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-61-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-62-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-63-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-64-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-65-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-66-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-67-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-68-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-69-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-70-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-71-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-72-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-73-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-74-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download
memory/2980-75-0x00000000003D0000-0x00000000007C1000-memory.dmp

Filesize
3.9MB

Download