laplas | 47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017

Analysis

max time kernel
156s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe
Size

5.8MB
MD5

52fe687ddad6e72d8c9f79b94543cb28
SHA1

ca3771cdc25a4c3618d6746d9bae20c8a0dc48c1
SHA256

47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017
SHA512

598fa486cae36ddcec368005b401da74c7c3a08586fd5995948bd9261bfadaa4d7eb4b9306bfdc99cdfc09fe93579164ba67dd090e3f6f0cc689bbdae586e8d7
SSDEEP

98304:dFMwKUb75oO8EL2TJgmgUiN+RJ/BC09WXSEKbSFa+UKiUsf+DltYg4:dFMwtPm/Em3x0cJ/BCmWzcKiXUltY

Score

10^/10

laplas clipper stealer

Malware Config

Extracted

Family

laplas

45.159.188.158

Attributes

api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1360	jGBsqiyHao.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5068	47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe
5068	47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe
5068	47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe
5068	47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe
1360	jGBsqiyHao.exe
1360	jGBsqiyHao.exe
1360	jGBsqiyHao.exe
1360	jGBsqiyHao.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 940	5068	47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe	92
PID 5068 wrote to memory of 940	5068	47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe	92
PID 5068 wrote to memory of 940	5068	47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe	92
PID 940 wrote to memory of 2972	940	cmd.exe	94
PID 940 wrote to memory of 2972	940	cmd.exe	94
PID 940 wrote to memory of 2972	940	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe
"C:\Users\Admin\AppData\Local\Temp\47c1302a6362defa7ae3e1d9f3f67059fc147677fdac70aa394583280ff54017.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn GbXLuFISha /tr C:\Users\Admin\AppData\Roaming\GbXLuFISha\jGBsqiyHao.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn GbXLuFISha /tr C:\Users\Admin\AppData\Roaming\GbXLuFISha\jGBsqiyHao.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:2972

C:\Users\Admin\AppData\Roaming\GbXLuFISha\jGBsqiyHao.exe
C:\Users\Admin\AppData\Roaming\GbXLuFISha\jGBsqiyHao.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GbXLuFISha\jGBsqiyHao.exe

Filesize
25.8MB

MD5
ff1273c9962541fb0cfca3e469f83a1e

SHA1
3ad025dfdb7a3838d7dd4b6398a8373a2ecd53a4

SHA256
e1a4a263dae44bf0a703ab7b14756ac36d5a2e7fb066cb6a5b02e1feb6d4ab22

SHA512
6cc39b2b4fcc759822db00e4c0ee5d2c816da0b77ffe5f3e080ec626f2cd707f0dd2b148eaaa5b527259defac5fa62eb39162de1c17ccc16c31251478071e7e3

Download Submit
memory/1360-21-0x00000000002E0000-0x0000000001036000-memory.dmp

Filesize
13.3MB

Download
memory/1360-16-0x0000000001490000-0x0000000001491000-memory.dmp

Filesize
4KB

Download
memory/1360-17-0x00000000015E0000-0x00000000015E1000-memory.dmp

Filesize
4KB

Download
memory/1360-19-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/1360-20-0x0000000001620000-0x0000000001621000-memory.dmp

Filesize
4KB

Download
memory/1360-18-0x0000000001600000-0x0000000001601000-memory.dmp

Filesize
4KB

Download
memory/1360-15-0x0000000001480000-0x0000000001481000-memory.dmp

Filesize
4KB

Download
memory/5068-3-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/5068-13-0x0000000000B40000-0x0000000001896000-memory.dmp

Filesize
13.3MB

Download
memory/5068-11-0x0000000000B40000-0x0000000001896000-memory.dmp

Filesize
13.3MB

Download
memory/5068-7-0x0000000000B40000-0x0000000001896000-memory.dmp

Filesize
13.3MB

Download
memory/5068-2-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/5068-6-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/5068-0-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/5068-5-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/5068-4-0x0000000000B40000-0x0000000001896000-memory.dmp

Filesize
13.3MB

Download
memory/5068-1-0x0000000001D30000-0x0000000001D31000-memory.dmp

Filesize
4KB

Download