laplas | 55163961897f6ca084044696de2b862ca6271f6f2b5a175752b0aa7f4b572d66

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 264KB
Sample230311-te3beacb6t
SHA256 55163961897f6ca084044696de2b862ca6271f6f2b5a175752b0aa7f4b572d66
MD5 406ae82ddae342bf253af77432145104
SHA1 15c24bb700696ab65a74c9fe26410d15b856c0ab
SHA512 6f98d8de305c888175e385cefd55395f977e84b57ef74d7e2fd3b61a8a8f6fbc0cc263386737a5512bd541bb84899db181a79dfb331e3bc45386fca3896a61ea
SSDEEP 6144:EqoJ4muj5QsR9hyTdzEiOKIgvQ1JLe3GVXlx:to4DKuDy5/zLULDVX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
2040	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1152	1452	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1452	file.exe
1452	file.exe
2040	svcservice.exe
2040	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2040	1452	file.exe	84
PID 1452 wrote to memory of 2040	1452	file.exe	84
PID 1452 wrote to memory of 2040	1452	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 1120
  2⤵
  - Program crash
  PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1452 -ip 1452
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcservice.exe

Path C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Size 759.5MB
SHA256 74e468ea87acd32649ccee1a9a555232437514cd43388843aa61e522ab6aee69
MD5 c0842e6efe027dea5d78a5f7bed926da
SHA1 03f5c63355da4e411b3c4ee5bf7806673d6eb8fa
SHA512 a00a5223aa3d5333b0aecd22e4c0d6315fe0848627637603db6e6477492e66596c0c9f5e74e9afa628ca72bbeb902fcc27128e64fa01628a7f0116e7136b4074
SSDEEP 393216:MWlV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7l3:Mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcservice.exe

Path C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Size 675.6MB
SHA256 10f629d54cce43641caf45919f9e06782b411d8a6ad12e98f3af556faf5a2b81
MD5 1df95261a85ebab2846020488721707d
SHA1 5db4ca2c5c04d7a4337451a25e38a0399d7737cb
SHA512 d4df6d8579d86de4a060ea1ccfe419de7ca59ac38e84adde310760fc6c9aadb48180e471b4cbd2d32ff2af75c3a09caa0d1454b46bfbe4fdb654baf8c2fdf231
SSDEEP 393216:MWlV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7l7:Mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcservice.exe

Path C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Size 661.3MB
SHA256 24a47a155562ab1926ac1773fabdda1bd560deb39b14166e5c970141e03e0b18
MD5 983423d250474dbf586af6ade7589d87
SHA1 342566a1545baa8c4aef7037aef71ff515f76829
SHA512 5f6271cf894a52c0d80089604c2576eb12989b98dfec3ebdcb5ffdac7942dd1b68471293cfbea15368cd23e2bad5309a35d0a536b22f3e756b263e34f8a047e7
SSDEEP 393216:MWlV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7lV7ly:MD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1452-134-0x0000000000590000-0x00000000005CE000-memory.dmp

Download

memory/1452-135-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/1452-136-0x0000000000590000-0x00000000005CE000-memory.dmp

Download

memory/1452-138-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/1452-148-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/2040-149-0x0000000000400000-0x00000000004C1000-memory.dmp

Download

memory/2040-150-0x0000000000400000-0x00000000004C1000-memory.dmp

Download