LP-Notes

Executive Summary

LP-Notes is a lightweight Windows credential stealer used by MuddyWater to harvest passwords from browsers, Credential Manager, and other sources. The stolen credentials are written to *lp-notes.txt* and exfiltrated via an HTTP/HTTPS C2 channel, enabling attackers to gain broad lateral movement potential.

LP-Notes is a Windows‑based credential stealer developed in C/C++ and distributed as part of the MuddyWater campaign. The malware captures authentication data from multiple sources on the infected system—including stored credentials in browser profiles, Windows Credential Manager entries, and any other plaintext password files—and writes the harvested items to a file named *lp-notes.txt*. After collecting the information, LP‑Notes transmits the content of this text file over an HTTP or HTTPS channel to an attacker‑controlled command‑and‑control server. The simple output format makes post‑exploitation data aggregation straightforward for adversaries while keeping the footprint minimal; the binary itself is lightweight and typically resides in temporary directories (e.g., %TEMP%) before being deleted. The tool demonstrates a classic “dropper” model common to MuddyWater, combining credential theft with rudimentary persistence mechanisms such as writing registry keys or scheduled‑task remnants. Although its capabilities are focused on stealing credentials, the attack chain can be extended by combining LP‑Notes with other utilities included in the same campaign. Overall, LP‑Notes represents a targeted, stealthy component of an ongoing threat actor’s toolkit that prioritizes quick extraction and exfiltration of access data from Windows platforms.

Key Capabilities

• Harvests stored web browser passwords
• Collects Windows Credential Manager entries
• Writes harvested data to lp-notes.txt file
• Exfiltrates credentials over HTTP/HTTPS

ATT&CK Techniques

Recommended Actions

• Deploy hosts‑based intrusion detection rules that flag creation of *lp-notes.txt* in temp or roaming directories
• Configure endpoint protection to detect and block LP-Notes binaries based on their known SHA‑256 hashes
• Whitelist legitimate temporary files while blocking suspicious writes to *lp-notes.txt*
• Implement network segmentation and monitor outbound HTTP/HTTPS traffic for anomalous credential payloads
• Apply least‑privilege principles and disable local administrative accounts where possible

Suggested Tags