laplas | ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76

General

Target

ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
Size

7.5MB
MD5

fb0deff37fe12bbc4f0c1fe21e2d15ef
SHA1

180325b8b6e64638e167601c67cd9c53331ba9f6
SHA256

ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76
SHA512

9fc013111994e943fd800abeb543563713eebebcd940b28973809a40d85271f0ed781dd95ca508e55788de2e2a575b1cb8734636f15b51a9d68f773b2cb4e73d
SSDEEP

196608:bdj1WcTeKCVpVAKegYv6Pvz7xCVfQeYDprOtpN6x1Cd:RReKaAlRgxMfvihOwxy

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://185.174.137.94

Attributes

api_key
b54641cc29f95948635d659de94166b4528e39706396a99bb9c54497b2ee3421

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
4216	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
4216	svcservice.exe
4216	svcservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
4216	svcservice.exe
4216	svcservice.exe
4216	svcservice.exe
4216	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4216	3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	66
PID 3476 wrote to memory of 4216	3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	66
PID 3476 wrote to memory of 4216	3476	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	66

C:\Users\Admin\AppData\Local\Temp\ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
"C:\Users\Admin\AppData\Local\Temp\ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\online[2].txt

Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RIZDY293\regex[2].txt

Filesize
633B

MD5
c5298d2c78be8fdfc264eb6fe3e275f8

SHA1
f09de5f443da081efaff0155f422ca0375edd164

SHA256
de32b3c0549fde0dc5ac435a89f16a87832a0632b6602e75f552d07074081577

SHA512
5aeb5013b00e13cd8a172639bc7c675bd06cc0473ae9844c9c324e5c322987ddeff986bd4a8e620ce0ca9d1098a3ee8bbb4802789d1e89b0ec0cecf2f55a4853

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
821.5MB

MD5
1a0ce13d384ce763153d348ae39a226d

SHA1
431f47a8f70addcc54c734f2f80a4ed55f06489f

SHA256
b08f430835c2058d80d8b1a34f37bdbbdb316472cd323decc9631ed166a223d6

SHA512
9373d3bcfc283a86148aa00e9bc076c87b01763bbc1b00151cec012b36da3ae5428fa4f49a203a7960992b2d07fe9b5d2ad8486d883624153fddf9782c6f2d7b

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
821.5MB

MD5
1a0ce13d384ce763153d348ae39a226d

SHA1
431f47a8f70addcc54c734f2f80a4ed55f06489f

SHA256
b08f430835c2058d80d8b1a34f37bdbbdb316472cd323decc9631ed166a223d6

SHA512
9373d3bcfc283a86148aa00e9bc076c87b01763bbc1b00151cec012b36da3ae5428fa4f49a203a7960992b2d07fe9b5d2ad8486d883624153fddf9782c6f2d7b

Download Submit
memory/3476-122-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/3476-117-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/3476-123-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/3476-124-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/3476-125-0x0000000000E50000-0x00000000019FB000-memory.dmp

Filesize
11.7MB

Download
memory/3476-121-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/3476-120-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/3476-118-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/3476-119-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/4216-135-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/4216-136-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/4216-137-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/4216-138-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/4216-139-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/4216-140-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/4216-141-0x0000000000CC0000-0x000000000186B000-memory.dmp

Filesize
11.7MB

Download
memory/4216-134-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/4216-133-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing