Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2024 03:44

General

  • Target

    e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab.exe

  • Size

    6.1MB

  • MD5

    48978e12606c69a14525441154e7bfd5

  • SHA1

    7402deebde1bb439be4c938458f9139ff8ba16ce

  • SHA256

    e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab

  • SHA512

    08f7389f19c51b0070c87a129068867cdb1ea24d768ed29001796290182fa1fcb9a3a9a1fc1cd22c49ff251e0366f5dd380ddac7c64e08a2851f8cea287fe9f1

  • SSDEEP

    98304:dSPwB+aOipCWBR6K4OIiGMprhRp8kBdQ9UEUvQxXf1tpqinVruk:vB+aOiDUKzDrhQLZK0f1tQpk

Malware Config

Extracted

Family

laplas

C2

clipper.guru

Attributes
  • api_key

    7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • Laplas family
  • Executes dropped EXE 1 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab.exe
    "C:\Users\Admin\AppData\Local\Temp\e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C schtasks /create /tn yhaPqplDUY /tr C:\Users\Admin\AppData\Roaming\yhaPqplDUY\wWafNGtsey.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:864
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn yhaPqplDUY /tr C:\Users\Admin\AppData\Roaming\yhaPqplDUY\wWafNGtsey.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5016
  • C:\Users\Admin\AppData\Roaming\yhaPqplDUY\wWafNGtsey.exe
    C:\Users\Admin\AppData\Roaming\yhaPqplDUY\wWafNGtsey.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2612-15-0x0000000001450000-0x0000000001451000-memory.dmp

    Filesize

    4KB

  • memory/2612-26-0x00000000002C0000-0x000000000101E000-memory.dmp

    Filesize

    13.4MB

  • memory/2612-21-0x00000000002C0000-0x000000000101E000-memory.dmp

    Filesize

    13.4MB

  • memory/2612-22-0x00000000002C0000-0x000000000101E000-memory.dmp

    Filesize

    13.4MB

  • memory/2612-20-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2612-19-0x0000000003170000-0x0000000003171000-memory.dmp

    Filesize

    4KB

  • memory/2612-18-0x0000000003160000-0x0000000003161000-memory.dmp

    Filesize

    4KB

  • memory/2612-17-0x0000000003150000-0x0000000003151000-memory.dmp

    Filesize

    4KB

  • memory/2612-16-0x0000000001460000-0x0000000001461000-memory.dmp

    Filesize

    4KB

  • memory/4864-4-0x0000000003B20000-0x0000000003B21000-memory.dmp

    Filesize

    4KB

  • memory/4864-12-0x00000000013CB000-0x0000000001638000-memory.dmp

    Filesize

    2.4MB

  • memory/4864-7-0x0000000000F00000-0x0000000001C5E000-memory.dmp

    Filesize

    13.4MB

  • memory/4864-5-0x0000000003B40000-0x0000000003B41000-memory.dmp

    Filesize

    4KB

  • memory/4864-6-0x0000000003B50000-0x0000000003B51000-memory.dmp

    Filesize

    4KB

  • memory/4864-0-0x00000000013CB000-0x0000000001638000-memory.dmp

    Filesize

    2.4MB

  • memory/4864-3-0x0000000003B10000-0x0000000003B11000-memory.dmp

    Filesize

    4KB

  • memory/4864-2-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

    Filesize

    4KB

  • memory/4864-1-0x00000000039D0000-0x00000000039D1000-memory.dmp

    Filesize

    4KB