laplas | e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801

General

Target

e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
Size

727.5MB
MD5

48c16aa24e136ac2178fcae1457cd772
SHA1

f83867c8ee60730d95bc4158cb46b57eff495da6
SHA256

e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801
SHA512

d096786c45bf3490e31e64ffcddcd6ebcc29811a9b6164632c878958fa8c55c11c49776ab70a0acf2bbe8b92e845090f7d7d8d09c47815b87bec119a575851e9
SSDEEP

196608:ZOtzW0BrGc/4GmLcBh8YSZIEqsyZr2caC78C:kVW6Gc//B/xEh+a2

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://212.113.106.172

Attributes

api_key
a8f23fb9332db9a7947580ee498822bfe375b57ad7eb47370c7209509050c298

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
3936	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
3936	svcservice.exe
3936	svcservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
3936	svcservice.exe
3936	svcservice.exe
3936	svcservice.exe
3936	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3936	2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe	66
PID 2460 wrote to memory of 3936	2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe	66
PID 2460 wrote to memory of 3936	2460	e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe	66

C:\Users\Admin\AppData\Local\Temp\e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe
"C:\Users\Admin\AppData\Local\Temp\e8f6d821236f31d2eb041091dd52f973d204f29f1bffce4fdf6a9dfd87d68801.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6CI3IN3W\regex[2].txt

Filesize
633B

MD5
c5298d2c78be8fdfc264eb6fe3e275f8

SHA1
f09de5f443da081efaff0155f422ca0375edd164

SHA256
de32b3c0549fde0dc5ac435a89f16a87832a0632b6602e75f552d07074081577

SHA512
5aeb5013b00e13cd8a172639bc7c675bd06cc0473ae9844c9c324e5c322987ddeff986bd4a8e620ce0ca9d1098a3ee8bbb4802789d1e89b0ec0cecf2f55a4853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6RO0PN6W\online[2].txt

Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
1457.5MB

MD5
88e60d0d9a604c019a0a2a53322c7a66

SHA1
c13ef93bf968b50c01f73a2977f6c24eb46e6e18

SHA256
4d7a0b9a99582eb4769688cab9dc8a5777905150df7eb5d8252ea76773de79fd

SHA512
19069f71b0db7abdf46945a619e3c779634f3f6de2989fa4b2d04e05a3f069354385876124ad750d7dfb276573b3dc2dfa266d5d5ecf71032d5a231d1fa1f337

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
1457.5MB

MD5
88e60d0d9a604c019a0a2a53322c7a66

SHA1
c13ef93bf968b50c01f73a2977f6c24eb46e6e18

SHA256
4d7a0b9a99582eb4769688cab9dc8a5777905150df7eb5d8252ea76773de79fd

SHA512
19069f71b0db7abdf46945a619e3c779634f3f6de2989fa4b2d04e05a3f069354385876124ad750d7dfb276573b3dc2dfa266d5d5ecf71032d5a231d1fa1f337

Download Submit
memory/2460-123-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/2460-118-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/2460-124-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2460-125-0x0000000001B30000-0x0000000001B31000-memory.dmp

Filesize
4KB

Download
memory/2460-126-0x0000000000E80000-0x0000000001A30000-memory.dmp

Filesize
11.7MB

Download
memory/2460-122-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/2460-121-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/2460-119-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2460-120-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3936-136-0x00000000017E0000-0x00000000017E1000-memory.dmp

Filesize
4KB

Download
memory/3936-137-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/3936-138-0x0000000001B50000-0x0000000001B51000-memory.dmp

Filesize
4KB

Download
memory/3936-139-0x0000000001B70000-0x0000000001B71000-memory.dmp

Filesize
4KB

Download
memory/3936-140-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download
memory/3936-141-0x0000000001B90000-0x0000000001B91000-memory.dmp

Filesize
4KB

Download
memory/3936-142-0x0000000000B30000-0x00000000016E0000-memory.dmp

Filesize
11.7MB

Download
memory/3936-134-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/3936-135-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing