laplas | 4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19-03-2024 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe
Size

1.9MB
MD5

961751858d8b74b2dec9d4f165a0a8c0
SHA1

88ca04fb4d62052614bd9da2b333ab10f5e0bfa7
SHA256

4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64
SHA512

c9625844e4acd328977d0078889497e6d8a81025d6d5da787a4ae0b9ee0fa717ee543cd7e520d26f4480265c56c0ea07ae8cecd8518f72afc59d114c605fbe4c
SSDEEP

49152:7YjDgDQj0z0HG2SYE/LA386lYmBk1U5nuyYPcEaC:7YjsEjJ33JYmSa5owC

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2532	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2567984660-2719943099-2683635618-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2532	1624	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	77
PID 1624 wrote to memory of 2532	1624	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	77
PID 1624 wrote to memory of 2532	1624	4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe	77

C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe
"C:\Users\Admin\AppData\Local\Temp\4230177379ff0422741a5714ba02dbeccdac0edc6d2c1e4123827f23ff179e64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
1.6MB

MD5
d20d1163303862e0d3f4913a6ba9d819

SHA1
7d59033fbae2c8be37b04287fd11e10244c65707

SHA256
4ba319548e59c852cf413f0fb7a33624b46df953de6ba278ed3ae3465dfab836

SHA512
95aa714b351756cb472cbd8cc9ae8dc16cbbe8fe6875989d1b4b2096361adf5a168f62da1ef07e05972abf5666e2824ebc8eebe260c554cee5debef511a22259

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
1.5MB

MD5
9df8961aa7e289040e2213afefa3e996

SHA1
4acbc3a12190e5e0f082d7e3ffa71fce978776c1

SHA256
1aea7ae7a14c271664f1f6b66a6a3f53eb27ca8d4e8d72214c3e6bb38c8a3db5

SHA512
3cf3a7bb6126fea63f59de48ccef6b2ed082e192b4514c00f681a452f31980a79f25550332b167f3c479ea90b30d81815de2695b350036a7a0834169d54053b7

Download Submit
memory/1624-10-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/1624-1-0x0000000003AC0000-0x0000000003E90000-memory.dmp

Filesize
3.8MB

Download
memory/1624-2-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/1624-0-0x0000000003910000-0x0000000003ABA000-memory.dmp

Filesize
1.7MB

Download
memory/2532-15-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-20-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-8-0x0000000003930000-0x0000000003D00000-memory.dmp

Filesize
3.8MB

Download
memory/2532-11-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-7-0x0000000003780000-0x000000000392A000-memory.dmp

Filesize
1.7MB

Download
memory/2532-16-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-18-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-9-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-22-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-25-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-29-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-31-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-33-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-35-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/2532-37-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads