laplas | d69a2f5a40b24836d41ed75c3f34ef6e94720b3f2eebe9f994e02cf5828d52ce

Resubmissions

21/12/2022, 13:20

221221-qlc4bafe2v10

14/12/2022, 08:12

221214-j3vlcscc8w8

Analysis

max time kernel
45s
max time network
112s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/12/2022, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8kb.exe
Size 8KB
Sample221221-qlc4bafe2v
SHA256 d69a2f5a40b24836d41ed75c3f34ef6e94720b3f2eebe9f994e02cf5828d52ce
MD5 76eaba56a417350a74cdcfe2a31da10e
SHA1 a09e342318606c06cd441eaf3f1ba78cac5e138c
SHA512 d122df3d1cba501426a8caeef645e3b25bad2078f2fae4721c0aa91d69e31b74d2d7ecf579300f492a83a59c7e0a82a62774ef97e105b4690ddf773f846d5c86
SSDEEP 96:7Z83yfYaodPyaH1EWo0UYDQGAhNdcMu4cybu8xOL3yfXYPznlVc+PAFRvaf2sP0M:7ZtPWyavUSAlRR3fYL3c+PAFxaZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas stealer

Malware Config

Extracted

Family

laplas

clipper.guru

Attributes

api_key
db7db0e38e9ab3e5e7a2b9c3bd7244f4f2221d6fef4b9c2b51e4a8ff6aea925c

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with two variants written in Golang and C#.
stealer laplas

Executes dropped EXE 1 IoCs

pid	Process
1732	svcupdater.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
868	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	svcupdater.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1748	1812	8kb.exe	28
PID 1812 wrote to memory of 1748	1812	8kb.exe	28
PID 1812 wrote to memory of 1748	1812	8kb.exe	28
PID 1748 wrote to memory of 868	1748	cmd.exe	30
PID 1748 wrote to memory of 868	1748	cmd.exe	30
PID 1748 wrote to memory of 868	1748	cmd.exe	30
PID 1708 wrote to memory of 1732	1708	taskeng.exe	32
PID 1708 wrote to memory of 1732	1708	taskeng.exe	32
PID 1708 wrote to memory of 1732	1708	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\8kb.exe
"C:\Users\Admin\AppData\Local\Temp\8kb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C schtasks /create /tn \LrwPcGkHDN /tr "C:\Users\Admin\AppData\Roaming\LrwPcGkHDN\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \LrwPcGkHDN /tr "C:\Users\Admin\AppData\Roaming\LrwPcGkHDN\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:868

C:\Windows\system32\taskeng.exe
taskeng.exe {7D741315-BB91-42D5-86B8-458F1B13442F} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Roaming\LrwPcGkHDN\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\LrwPcGkHDN\svcupdater.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\LrwPcGkHDN\svcupdater.exe
Size 659.0MB
SHA256 462d65dfa5e0a6e27f8aff380ea67555cb835ba174b3fa317f06111f5e8fb030
MD5 9038f8a1c735681537ff968dccf2b2de
SHA1 c8d54b009037fa45fa0cb9de8483a597aef71fa3
SHA512 7266a00648b1d2d32b5a1103d079cab06d6fb6c8a83d2f3a5b6d6982b3916c9b2492ac8221e7ea7d7bb21f578d086b1d8315fbf44f435addf741cb3828750298
SSDEEP 12582912:8Jgjo9SCPfE+UVl1c0P/Imqi8qkCDoPpOnanaXRMjF4+Z8p/7K0:8Gjo9Ses+y1/ff8qxD0qanaXRc58l71
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\LrwPcGkHDN\svcupdater.exe
Size 659.0MB
SHA256 462d65dfa5e0a6e27f8aff380ea67555cb835ba174b3fa317f06111f5e8fb030
MD5 9038f8a1c735681537ff968dccf2b2de
SHA1 c8d54b009037fa45fa0cb9de8483a597aef71fa3
SHA512 7266a00648b1d2d32b5a1103d079cab06d6fb6c8a83d2f3a5b6d6982b3916c9b2492ac8221e7ea7d7bb21f578d086b1d8315fbf44f435addf741cb3828750298
SSDEEP 12582912:8Jgjo9SCPfE+UVl1c0P/Imqi8qkCDoPpOnanaXRMjF4+Z8p/7K0:8Gjo9Ses+y1/ff8qxD0qanaXRc58l71
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1732-60-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Download

memory/1812-54-0x0000000000900000-0x0000000000908000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads