laplas | e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2023, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe
Size

244KB
MD5

d2779449f8672bd4205df39b0b523ebe
SHA1

84101f1c60c21da288951150fdc7a163636a06f7
SHA256

e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c
SHA512

1135ad7edbd05be3bd1ff1d91285125a28ef0f7422a50825fc757251b5e86aadbb7d672851185ce6aa5e93dc76701c05bfc21c5f4d83bd961806f72b8eaf8f9e
SSDEEP

6144:NbtmtBqh+D76VayrfN7q3fqwZkMqFIhYJ:Nbthh/o+V7qPtP

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe

Executes dropped EXE 1 IoCs

pid	Process
3924	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	5116	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 3924	5116	e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe	86
PID 5116 wrote to memory of 3924	5116	e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe	86
PID 5116 wrote to memory of 3924	5116	e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe	86

C:\Users\Admin\AppData\Local\Temp\e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe
"C:\Users\Admin\AppData\Local\Temp\e1028352af138b56c740c27ed1c3f2244afcf9bc91776f3255acf05f4976ce5c.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 1112
  2⤵
  - Program crash
  PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5116 -ip 5116
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
836.2MB

MD5
aad5fdc316ea58076a33f2b94e4922e1

SHA1
aa734cad075998b217e269e1b51b237b5eb592f4

SHA256
44871ee16a27163d6f476d625e853144942d9e337e9dfca1a53351266c617aa7

SHA512
3d97f12e1c21a65be38025ddc61161e91cc3f3a7bf6d262a7fa546224ea7421b7c07d77951d6a9f581a9114653f97516366377136ccb8778a54c45166e3f84ff

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
808.9MB

MD5
540db7a180f45e26858718432bc68c47

SHA1
b3d803acc036919627dbcac68aecb59c4e76a36d

SHA256
d67d0d7a6bbd92dde344e284cd5402154872f97400728e1c069df5da107388ff

SHA512
3a9088d58949e6e6874b5b301149e09b54e4755a7b62d02faf53e8db9b671631480de3eee9dd359b51931ac2f931fea26abe19541cb438410bfee384f8d552b0

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
819.9MB

MD5
01368512a41736f23cc02216119e90c4

SHA1
2b3b462cbe48d164cfd69e8070dbb2cc0b09a5dd

SHA256
7308f2e620a8f054f5a51e6fabc9275ce85488000e6ff89399105beba8d13283

SHA512
b51f3c93fc1addf589355a33d8d2199b55401a80222ba6863c5369ab8b3d14fc0723be5485dfd143de437349aec2e73ae5db7f7fa65fcc88fea6aeb99f4dbec5

Download Submit
memory/3924-145-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3924-149-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5116-134-0x0000000002250000-0x000000000228E000-memory.dmp

Filesize
248KB

Download
memory/5116-140-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5116-147-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download