laplas | 4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe
Size

1.9MB
MD5

961751858d8b74b2dec9d4f165a0a8c0
SHA1

88ca04fb4d62052614bd9da2b333ab10f5e0bfa7
SHA256

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64
SHA512

c9625844e4acd328977d0078889497e6d8a81025d6d5da787a4ae0b9ee0fa717ee543cd7e520d26f4480265c56c0ea07ae8cecd8518f72afc59d114c605fbe4c
SSDEEP

49152:7YjDgDQj0z0HG2SYE/LA386lYmBk1U5nuyYPcEaC:7YjsEjJ33JYmSa5owC

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
5052	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 5052	2008	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	90
PID 2008 wrote to memory of 5052	2008	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	90
PID 2008 wrote to memory of 5052	2008	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	90

C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe
"C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
546KB

MD5
5e3d79ff43d947f640eeeb52f7850823

SHA1
6713ebcbd69a3803b5cf88f5974ca4ac81f1fc04

SHA256
82e08dc3f6f2a4d40fffeb53941ef71c7d8beb007c8434f515cf16eb741b55d5

SHA512
fd25aa065663bc91a724f742f2c19cdbc1efbddecc09232130c7f30bf4e43dc837601cc612540aa07f0911e46d6a38aec7e094029d23d9b4b4805a0c37a8406c

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
338KB

MD5
ad647bb812580673f8f06701d76b14aa

SHA1
8a179f9bf3a5e40827ecb883cb5b79e035a27293

SHA256
c3c5dfa153e268b7eaca51c2c000a529722b24ca91e19a11bc75c3fa480c8dd0

SHA512
11810f3c1396255f9771d1b35451cde96f70d5e919bacbb845f359f4967990fd7c627ff95b8eba43d3a3b74634a8a94dcebb53f1b6e84115a2e485e955c1f582

Download Submit
memory/2008-0-0x00000000039F0000-0x0000000003B9A000-memory.dmp

Filesize
1.7MB

Download
memory/2008-1-0x0000000003BA0000-0x0000000003F70000-memory.dmp

Filesize
3.8MB

Download
memory/2008-2-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2008-6-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2008-8-0x00000000039F0000-0x0000000003B9A000-memory.dmp

Filesize
1.7MB

Download
memory/2008-9-0x0000000003BA0000-0x0000000003F70000-memory.dmp

Filesize
3.8MB

Download
memory/5052-12-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-18-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-10-0x0000000003950000-0x0000000003D20000-memory.dmp

Filesize
3.8MB

Download
memory/5052-14-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-15-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-16-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-17-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-11-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-20-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-22-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-23-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-24-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-25-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/5052-26-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads