laplas | 201e514403766ce1e74673c361dab26a7386fcdf2f6971c9f3182f17b4089537

General

Target

ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
Size

7.5MB
MD5

fb0deff37fe12bbc4f0c1fe21e2d15ef
SHA1

180325b8b6e64638e167601c67cd9c53331ba9f6
SHA256

ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76
SHA512

9fc013111994e943fd800abeb543563713eebebcd940b28973809a40d85271f0ed781dd95ca508e55788de2e2a575b1cb8734636f15b51a9d68f773b2cb4e73d
SSDEEP

196608:bdj1WcTeKCVpVAKegYv6Pvz7xCVfQeYDprOtpN6x1Cd:RReKaAlRgxMfvihOwxy

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://185.174.137.94

Attributes

api_key
b54641cc29f95948635d659de94166b4528e39706396a99bb9c54497b2ee3421

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe

Executes dropped EXE 1 IoCs

pid	Process
1564	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
1564	svcservice.exe
1564	svcservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
1564	svcservice.exe
1564	svcservice.exe
1564	svcservice.exe
1564	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1564	5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	91
PID 5068 wrote to memory of 1564	5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	91
PID 5068 wrote to memory of 1564	5068	ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe	91

C:\Users\Admin\AppData\Local\Temp\ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe
"C:\Users\Admin\AppData\Local\Temp\ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
406.8MB

MD5
b898609e8ba99c68f89e7f3b2ebebc03

SHA1
00b36e72c86eeacfb3e108b66ce4eb220bdf78ec

SHA256
c7d240d5238675e267dc8d7d1057dd27cccc68e65360000523b361c6272f7541

SHA512
5d3b2562edb42393773ef630ca1b4350f9a8dd848bd3c626ce96bc83246a3f2239b14a0d439392cfb7c00e5c45db7be018368bb3677c0ba5525f7d0141db0444

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
295.0MB

MD5
05a6efeade5f4ab8bcd090f52d029fbc

SHA1
aad305b3650c6d41ad5f9e7949d66ef73ef9fca1

SHA256
1b8a67c4fab4fbe4ca2dde722543148f0438daf13e7e8e1ee78420716b93fb2e

SHA512
f21a292e298fe03dde4b3268fe128b65fd521cfb08bd93661bfda239f7fc5edfc1d31d6d7313ff2b6910d21b8148c6895934226f261446c45c67cc15c59428ee

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
291.5MB

MD5
229bcb9a835432d23edba23c2d99f01b

SHA1
2afd093ee5dbf61bd43556a6dccf0a93d805a970

SHA256
56a174e9a1bbd4b154c218a6f3d7ae767a16e1ab0829e40f513fcfc963d3c424

SHA512
0fa07e6a64ae4dd5e6a07e0ef4cecf6934c91ff05726e232997daa90ded2b20bd54e8845e86b0a8a8dcac0d1241b62aa5d4ca327df05583fb0cf776f1da3ef41

Download Submit
memory/1564-158-0x00000000016F0000-0x00000000016F1000-memory.dmp

Filesize
4KB

Download
memory/1564-159-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/1564-163-0x0000000000B30000-0x00000000016DB000-memory.dmp

Filesize
11.7MB

Download
memory/1564-162-0x0000000001730000-0x0000000001731000-memory.dmp

Filesize
4KB

Download
memory/1564-161-0x0000000001720000-0x0000000001721000-memory.dmp

Filesize
4KB

Download
memory/1564-160-0x0000000001710000-0x0000000001711000-memory.dmp

Filesize
4KB

Download
memory/1564-157-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/1564-156-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/1564-155-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/5068-134-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/5068-135-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/5068-136-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/5068-133-0x00000000016D0000-0x00000000016D1000-memory.dmp

Filesize
4KB

Download
memory/5068-137-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/5068-141-0x0000000000590000-0x000000000113B000-memory.dmp

Filesize
11.7MB

Download
memory/5068-140-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/5068-139-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/5068-138-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing