laplas | ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76

General

Target

ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
Size

7.5MB
MD5

fb0deff37fe12bbc4f0c1fe21e2d15ef
SHA1

180325b8b6e64638e167601c67cd9c53331ba9f6
SHA256

ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76
SHA512

9fc013111994e943fd800abeb543563713eebebcd940b28973809a40d85271f0ed781dd95ca508e55788de2e2a575b1cb8734636f15b51a9d68f773b2cb4e73d
SSDEEP

196608:bdj1WcTeKCVpVAKegYv6Pvz7xCVfQeYDprOtpN6x1Cd:RReKaAlRgxMfvihOwxy

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://185.174.137.94

Attributes

api_key
b54641cc29f95948635d659de94166b4528e39706396a99bb9c54497b2ee3421

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
4352	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
4352	svcservice.exe
4352	svcservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
4352	svcservice.exe
4352	svcservice.exe
4352	svcservice.exe
4352	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 4352	2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	66
PID 2100 wrote to memory of 4352	2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	66
PID 2100 wrote to memory of 4352	2100	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	66

C:\Users\Admin\AppData\Local\Temp\ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
"C:\Users\Admin\AppData\Local\Temp\ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
777.5MB

MD5
4a0637c62ca9b2ab146cdbb8379d698b

SHA1
2247e8fbb92c9fffa6c298dc37ef8a764a446aff

SHA256
65a7df5a7d977a91fa6ac1622114d9574e2f006764d92e2605f031d7666bb6c4

SHA512
9a87b4359072d734221369ac3f635a0174a15847473633df740de1269caa6c57f6d9bc230d16292825f022a72d507e1af693b793576b992bc3d6ad3749304e06

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
777.5MB

MD5
4a0637c62ca9b2ab146cdbb8379d698b

SHA1
2247e8fbb92c9fffa6c298dc37ef8a764a446aff

SHA256
65a7df5a7d977a91fa6ac1622114d9574e2f006764d92e2605f031d7666bb6c4

SHA512
9a87b4359072d734221369ac3f635a0174a15847473633df740de1269caa6c57f6d9bc230d16292825f022a72d507e1af693b793576b992bc3d6ad3749304e06

Download Submit
memory/2100-125-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/2100-123-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/2100-124-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/2100-120-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/2100-126-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/2100-127-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/2100-128-0x00000000001D0000-0x0000000000D7B000-memory.dmp

Filesize
11.7MB

Download
memory/2100-122-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download
memory/2100-121-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/4352-137-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/4352-136-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/4352-138-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/4352-139-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/4352-140-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/4352-141-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/4352-142-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/4352-143-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/4352-144-0x0000000000D00000-0x00000000018AB000-memory.dmp

Filesize
11.7MB

Download

Analysis

Sharing