laplas | 6227d0d5d716d3396eabe9522bdac2bac6731873dfcc9ac1ed38562fd775fb55

General

Target

00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
Size

7.5MB
MD5

f5d957a42f578847664cacb8a4c3d695
SHA1

5affbea912936570480b7a6a0a7e67c6a2f62ec9
SHA256

00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc
SHA512

07821df782858665c810e959e92f78de4af56e8d090069c5637537338244f9348f7a878bff95d72620b4c092fd97cfb2d15ffe1c097c36a86399a478ea406980
SSDEEP

196608:ZOtzW0BrGc/4GmLcBh8YSZIEqsyZr2caC78:kVW6Gc//B/xEh+a

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://212.113.106.172

Attributes

api_key
a8f23fb9332db9a7947580ee498822bfe375b57ad7eb47370c7209509050c298

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe

Executes dropped EXE 1 IoCs

pid	Process
2128	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
2128	svcservice.exe
2128	svcservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
2128	svcservice.exe
2128	svcservice.exe
2128	svcservice.exe
2128	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2128	1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe	85
PID 1664 wrote to memory of 2128	1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe	85
PID 1664 wrote to memory of 2128	1664	00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe	85

C:\Users\Admin\AppData\Local\Temp\00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
"C:\Users\Admin\AppData\Local\Temp\00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
723.9MB

MD5
6aff4e54ebaff01d9556e1d5098e436a

SHA1
b457263b4333b9dd798ffbb9ec9b91e176a7d72b

SHA256
255b2d34282f5d9743563fefa393a978f9f2c14de4045df19554b175193dfbc7

SHA512
90d569b4b7220cd75323d414f4a8917bd7ae433a8596916a19d7130e5c70e7343b10b820a8a3413da83f6dbeea10e96600f14a662c30df256d815ea73888e1a5

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
691.1MB

MD5
a553a67af622e69dc946abd55a392138

SHA1
39146b9b5232cedd8d0f69d443e4d24dec77c9b9

SHA256
7d20cc4c140310d2f2ce59156c1538f019bbf49956624c5baf5c2d1b21b04513

SHA512
d0891cd1ed28b2b492f449bae6f385667c8bada7d48800cab1b03e8b29fadc6ccc9b0834c571d4774ed9436efb08285f952c26431a3b3f431fbc50f63d722c2b

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
665.6MB

MD5
14fb00fea6578a41be372742cb78c44a

SHA1
11c301a4259fbfee8152e19b2a848e1653ca10bc

SHA256
0e6430abb3cc91a95d84fafcf94dcc3de7d7400bde62bde45fb8d2553c0a3dc0

SHA512
c80e70d7577d44cd0065831eb1d775b994dd7f8a04ad9a4cf3999ed2d7b754c6e3f89f65cb1f634e1da2e7171f1fd5a89d066112ffaf1b4099814c7e03e4abb4

Download Submit
memory/1664-138-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/1664-137-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/1664-133-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1664-139-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/1664-140-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/1664-141-0x0000000000CE0000-0x0000000001890000-memory.dmp

Filesize
11.7MB

Download
memory/1664-136-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/1664-135-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1664-134-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/2128-155-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/2128-156-0x0000000001BD0000-0x0000000001BD1000-memory.dmp

Filesize
4KB

Download
memory/2128-157-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2128-158-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/2128-159-0x00000000036D0000-0x00000000036D1000-memory.dmp

Filesize
4KB

Download
memory/2128-160-0x00000000036E0000-0x00000000036E1000-memory.dmp

Filesize
4KB

Download
memory/2128-161-0x00000000036F0000-0x00000000036F1000-memory.dmp

Filesize
4KB

Download
memory/2128-162-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/2128-163-0x00000000009C0000-0x0000000001570000-memory.dmp

Filesize
11.7MB

Download

Analysis

Sharing