laplas | e2279ce8c31ce3ff250d0942cbfd52a3ec6b04437e8ee7facf8c4f68a131328d

Analysis

max time kernel
143s
max time network
130s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/03/2023, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 330KB
Sample230309-2586msaf86
SHA256 e2279ce8c31ce3ff250d0942cbfd52a3ec6b04437e8ee7facf8c4f68a131328d
MD5 2a18774f6e9cfb896bce930f24ff0402
SHA1 3678c97cc3d8bec04670494fb80bf80fc906f30d
SHA512 a8e210e3a617badc7a8e2dd97d03e31ac1d51d47c4979cf86bd625ed1073e044a50b91758d606b1518c24da8302a2c98b50ca9dd0068bda4dd2b31d4a318e010
SSDEEP 6144:YILU3r5Kw0ysBrQt/kD+yUuKomudSX4LCIV:fg3rr0Z4MqyUluQi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1692	svcservice.exe

Loads dropped DLL 2 IoCs

pid	Process
1148	file.exe
1148	file.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1692	1148	file.exe	27
PID 1148 wrote to memory of 1692	1148	file.exe	27
PID 1148 wrote to memory of 1692	1148	file.exe	27
PID 1148 wrote to memory of 1692	1148	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcservice.exe

Path C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Size 398.4MB
SHA256 68e41635562a713834159be91bd4f647895a5c8db41da0f88cdf7ca3e38f8d4e
MD5 a98edc47a06df3d2f4901fc63dc9628c
SHA1 a4830622da94ad6ef7f6c24648e36a3d88805a3e
SHA512 eee9c3f98b42ae6adfbb5e0ed1ea0db1661cce11fdbcfcf284707b5f97cc4db3f0395005b5745aac77684850f83088680baa7095149542b4f2bfd5ba7ea6e376
SSDEEP 1572864:dHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH0:e
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcservice.exe

Path C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Size 417.8MB
SHA256 44b93b64f89785fa409b951c413c2dc582657539f31b5ff153ba02a60ed7af5f
MD5 b0631bb6f3c9879673985980dcf6cbdd
SHA1 861ca91d859f9a338ed6ad32483f410b2e104deb
SHA512 db42936691ee9e71a5faf4306a75c716a9de45e2d1f6fe75ef5f7192d549468cce7bb22f4549a20a67ab820bb12c69e92cb69cb5ee1f6284974ca4593e36b8d7
SSDEEP 1572864:dHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHu:U
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcservice.exe

Path \Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Size 413.6MB
SHA256 473ffba943181fc6215b6130b25b7d4a4ce8b3437e42087ff8679dc20e7d7d8d
MD5 1923a4788cff214681e65b477fe1043b
SHA1 e0a050a5730196ecda306535d9b27130c3dca0fe
SHA512 54d4a6ec9e3cfc6602ec534b894aac0ce39f5cc182dd1485daae1c674ba48449f33c4c272c213aecc346d4c90cf985e8b53b9e82eaa9519c9df8e0912fd2852c
SSDEEP 1572864:dHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHY:i
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcservice.exe

Path \Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Size 440.4MB
SHA256 b90a5b06df57dff89b24c85dd48dfb72e1fabd4847e6d226f8f8852eca58f32b
MD5 7c1907d032c233e9ea1b5cbc9d9f506f
SHA1 02e8f1a23334d9fe178ba837557028776ffd39b9
SHA512 a181a86c9340cb04912a3a14464d5cef4fc94cc3f971f5c525ba088487d0e35fdc4dc31ee18d57d542853358d6e66fd467ed8208566d6133e4728373774316ef
SSDEEP 1572864:dHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHC:4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1148-55-0x00000000003C0000-0x00000000003FC000-memory.dmp

Download

memory/1148-64-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

memory/1692-69-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads