laplas | 876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

Resubmissions

24-11-2022 16:34

221124-t26x4sfd96 10

03-11-2022 08:46

221103-kpa58sagaj 8

Analysis

max time kernel
49s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80750ddfb5cfe9eb8e2adac60f372534.exe
Size

4.8MB
MD5

80750ddfb5cfe9eb8e2adac60f372534
SHA1

a720efe2b3ef7735efd77de698a5576b36068d07
SHA256

876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04
SHA512

bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f
SSDEEP

49152:RAM2vrGxtRJHHc1RmqAhaShRgdGMYYqWxvdTBB0IEqYjla27EdS5g+A:mMgGxtU1RmqA3xsquvPEdZi+A

Score

10^/10

laplas stealer

Malware Config

Extracted

Family

laplas

clipper.guru

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
stealer laplas
Executes dropped EXE 1 IoCs

Processes:

svcupdater.exe

pid process

1416 svcupdater.exe
Loads dropped DLL 2 IoCs

Processes:

taskeng.exe

pid process

1528 taskeng.exe
1528 taskeng.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1860 schtasks.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 3 Go-http-client/1.1

pid	process
1416	svcupdater.exe

pid	process
1528	taskeng.exe
1528	taskeng.exe

pid	process
1860	schtasks.exe

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

80750ddfb5cfe9eb8e2adac60f372534.execmd.exetaskeng.exe

description	pid	process	target process
PID 1612 wrote to memory of 1952	1612	80750ddfb5cfe9eb8e2adac60f372534.exe	cmd.exe
PID 1612 wrote to memory of 1952	1612	80750ddfb5cfe9eb8e2adac60f372534.exe	cmd.exe
PID 1612 wrote to memory of 1952	1612	80750ddfb5cfe9eb8e2adac60f372534.exe	cmd.exe
PID 1952 wrote to memory of 1860	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1860	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 1860	1952	cmd.exe	schtasks.exe
PID 1528 wrote to memory of 1416	1528	taskeng.exe	svcupdater.exe
PID 1528 wrote to memory of 1416	1528	taskeng.exe	svcupdater.exe
PID 1528 wrote to memory of 1416	1528	taskeng.exe	svcupdater.exe

C:\Users\Admin\AppData\Local\Temp\80750ddfb5cfe9eb8e2adac60f372534.exe
"C:\Users\Admin\AppData\Local\Temp\80750ddfb5cfe9eb8e2adac60f372534.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\cmd.exe
cmd.exe "/C schtasks /create /tn \kBqZwNWVQe /tr \"C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\system32\schtasks.exe
schtasks /create /tn \kBqZwNWVQe /tr \"C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
3⤵
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\taskeng.exe
taskeng.exe {72B8A792-96E3-4F2A-9713-F716EC16ACBD} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
2⤵
- Executes dropped EXE
PID:1416

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit
C:\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit
\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit
\Users\Admin\AppData\Roaming\kBqZwNWVQe\svcupdater.exe
Filesize
4.8MB

MD5
80750ddfb5cfe9eb8e2adac60f372534

SHA1
a720efe2b3ef7735efd77de698a5576b36068d07

SHA256
876e6f8cecf5d23d21e11a3a459357c763807614ba7d4ecee9c0537b5936da04

SHA512
bf4100fc99282c91ec03c8c234d320321e21e5e4120c45c2cd5cfeaffcf07d4e67143e61407b570448bea16b44ed0bf7ad720e61ca2ae5d30d804c5fc8266d6f

Download Submit
memory/1416-59-0x0000000000000000-mapping.dmp

Download
memory/1860-55-0x0000000000000000-mapping.dmp

Download
memory/1952-54-0x0000000000000000-mapping.dmp

Download