laplas | f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57

Analysis

max time kernel
128s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

197bebce417f5ba6c178ee34037fbdea.exe
Size

10.0MB
MD5

197bebce417f5ba6c178ee34037fbdea
SHA1

d9dc871f8e61e590115bae9b0d842fae0f8f52b9
SHA256

f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57
SHA512

8cf7bde02dc86518d60f3836e86d3def9b9fcaf4242eaefccc6eaf2ffe61e7eaebc5d2ca114fc11169854726cce125e7f71cdb92214c1e248b4006afa2b223ad
SSDEEP

49152:4EjwvlIKv05z+UERnIcYmWjc3Cdhu5E9UFiqeb0/B1Y4kIZxdez6LK+/BV6Cbfoq:OlhWzZ6hnEciqem

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://lpls.tuktuk.ug

Attributes

api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2232	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2928	197bebce417f5ba6c178ee34037fbdea.exe
2928	197bebce417f5ba6c178ee34037fbdea.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	197bebce417f5ba6c178ee34037fbdea.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2232	2928	197bebce417f5ba6c178ee34037fbdea.exe	28
PID 2928 wrote to memory of 2232	2928	197bebce417f5ba6c178ee34037fbdea.exe	28
PID 2928 wrote to memory of 2232	2928	197bebce417f5ba6c178ee34037fbdea.exe	28

C:\Users\Admin\AppData\Local\Temp\197bebce417f5ba6c178ee34037fbdea.exe
"C:\Users\Admin\AppData\Local\Temp\197bebce417f5ba6c178ee34037fbdea.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
620.2MB

MD5
5332429000a093e8d1fa796e761d3aa2

SHA1
fddc06d0073f66d8da7575b90943ece20b04acdc

SHA256
8a02f0aae77f47655a36c7335b559a0cd2aa404d7a6f70c70420d7fc28524c92

SHA512
934f797ba3c6ce79bb88bb678ec68e05e839cb356f79962da574f10e7eb8e515c2073a00ea8feacf3dda16156ed6d152e951e0a8df0eadba31534fcb81c39a71

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
624.8MB

MD5
c5fccad545a12a1d746e0e549a336061

SHA1
1767fb8e2fb88ff9674f42672463765c3c5fe473

SHA256
8782ff5a52cb17458b62672aaa463a4655dc867e6463fe88366aaca3d3ff011a

SHA512
c9098ba64345e46e6cc3b9713098a222d5e34d8b4df4c399b06dd187efd81ec8f576fb9ff129c307f70bb4bfa43c863483acb6171f98e68924450116561ffb5a

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
622.9MB

MD5
50599b2efbf08937ab3d379f571f58b8

SHA1
27a91392061baa6cab85d14665dac47c90b84cd6

SHA256
933834daaee26b2ccc44c2bf76534962c7dddf3e4d7f2153b8fc2764b600a3e3

SHA512
86426edf6147c3c79a9c077c36dd0aa1c8b3afb3f5aec766a2191c833139e230e94a21ce8593d211efd403cc5ed407a7b31aaa70028e8ff0e9887b6b1a9fe7f8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads