laplas | 65015d75377ba52e3f2cbc1680a28a8533dc1603b3b28264f4aa3b5152806179

Analysis

max time kernel
99s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2023, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ecbd1048c3f9f66e906c8320114ac89.exe
Size 8KB
Sample230306-at2tmshd7s
SHA256 65015d75377ba52e3f2cbc1680a28a8533dc1603b3b28264f4aa3b5152806179
MD5 6ecbd1048c3f9f66e906c8320114ac89
SHA1 ba963ece1989cbacd47da2b971faa3f497386015
SHA512 aca1ec429a89d2a285c7f359889b1c68d96942117d6adc82966f240c268d207e951e405518b760039be1e7400bf8d70ad5ee1b3c112d32c031b77ac63bd49d60
SSDEEP 192:BHnxSqD610EcsYt4Y/dQpyOYJ3X8VkRm:FnveVYtRypyPJ3MKRm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas clipper stealer

Malware Config

Extracted

Family

laplas

http://104.193.254.45

Attributes

api_key
3682a4b856cc8db9e7c6f4deda4a6fdc2a8f662f4cc34c6d4365d36e3ed0ab52

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
3856	svcupdater.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
700	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	svcupdater.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4080	1804	6ecbd1048c3f9f66e906c8320114ac89.exe	91
PID 1804 wrote to memory of 4080	1804	6ecbd1048c3f9f66e906c8320114ac89.exe	91
PID 4080 wrote to memory of 700	4080	cmd.exe	93
PID 4080 wrote to memory of 700	4080	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6ecbd1048c3f9f66e906c8320114ac89.exe
"C:\Users\Admin\AppData\Local\Temp\6ecbd1048c3f9f66e906c8320114ac89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C schtasks /create /tn \PwduTIrMqA /tr "C:\Users\Admin\AppData\Roaming\PwduTIrMqA\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \PwduTIrMqA /tr "C:\Users\Admin\AppData\Roaming\PwduTIrMqA\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:700

C:\Users\Admin\AppData\Roaming\PwduTIrMqA\svcupdater.exe
C:\Users\Admin\AppData\Roaming\PwduTIrMqA\svcupdater.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\PwduTIrMqA\svcupdater.exe
Size 597.5MB
SHA256 2311435275b6616f3c0cc691961b312b91a01e64174c609df6a7b497e1cbea9b
MD5 fcc47af3b0f9f1ae60693edf2e5e1e50
SHA1 345c5c0c447f8f2a687b29144358e53ecfdf90a5
SHA512 688bdb0a2fdd6291fd001f0126684d7c653862c1f2570a4d788f339cd09c1a233b75eca10b8307c5ee213772641c145c24c5439329dff7c58a0aa54f06f34dc3
SSDEEP 12582912:fBsu5Bm0FQKycbEsgcc7BRR2n2WzpyhCk7iecOH84XU/r8Govusj9foO8icpJ:2u5OcbEsmBRR22WzAhCk7iOcku6cis
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\PwduTIrMqA\svcupdater.exe
Size 590.3MB
SHA256 440fe298f6be1f980b1a74799c8988ecd65b74792394c5de5534ad07f9c030fc
MD5 fc7d7139028c6f7529f30256818144c2
SHA1 4df98f3a3af434ec9b375de2a4dd954f35441a3f
SHA512 d7d16b76ce7a1df6926ae4ab6d50bbc7e9e3ab820b567aabf32f705ef0a9d1392db4f6ba2bedbe3fec33a5a622588856f816f83c84701b553d346e72bce9c37d
SSDEEP 12582912:fBsu5Bm0FQKycbEsgcc7BRR2n2WzpyhCk7iecOH84XU/r8Govusj9foO8icV:2u5OcbEsmBRR22WzAhCk7iOcku6ciu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1804-133-0x0000000000060000-0x0000000000068000-memory.dmp

Download

memory/3856-140-0x000000001C310000-0x000000001C320000-memory.dmp

Download

memory/3856-141-0x000000001C310000-0x000000001C320000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads