laplas | f8918613f0ff3b2f7e97653c6c94cef0cb22275e3f9b05bf5aa44ad2bdeabfec

General

Target

348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
Size

7.3MB
MD5

99f16ab6ab670935b5aa5c84b1b5f6bd
SHA1

59f375481cdfe246d1ddcaada9941e16dcfda297
SHA256

348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057
SHA512

845e76e29adb6b7890a3a5c508e27b9731e9872bc791eeefb146b23e0e737280d19e4df1203b719f8e168a8c8a0d8ae1b4bf670da5d264bde1eece8663624d70
SSDEEP

196608:Ltu5ODXM16mjmKSRFWuxx6ruj3nK/x9jWuy:L05ODcgR6mix1

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://185.106.92.104

Attributes

api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
396	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
396	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
2536	svcservice.exe
2536	svcservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
396	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
396	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
2536	svcservice.exe
2536	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2536	396	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe	86
PID 396 wrote to memory of 2536	396	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe	86
PID 396 wrote to memory of 2536	396	348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe	86

C:\Users\Admin\AppData\Local\Temp\348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
"C:\Users\Admin\AppData\Local\Temp\348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
48.9MB

MD5
c89b937959023727e65bc30dfdffe10c

SHA1
31a3335b15c83cc4894a78f6946f2b8672b0b1d6

SHA256
1946cf37a6f866bf7335073be10a2a1174567821bbe373055ee03dc911a48c29

SHA512
e546e1baae08d3643d827549edf304bed366e19dd04b417a1918a40e747cd1b2f75718463b9d305c607adb699255bb4fff0bc05c283f426b3f7695b416005ef0

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
46.4MB

MD5
ef554c56889a6e1ff5a99a14235d35e7

SHA1
c7c9dd4840a1018678312eb1862acb77de7f9e81

SHA256
200c2e839547767475d1714cb7abc3b4dd4c8659281df2df8ca2a6212fa50620

SHA512
fc28f417adbc103b21c5855b0dc029aa32f70c00a29cdc377507bea51e3a10cd67eaaffed5313bf9cd11081893bb9bb940f314ef517ab9b71ff4929373b591ac

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
45.6MB

MD5
6e8987dfafdf0b6c2f5f50aeedfc80fa

SHA1
969252edeb01efc3dc9511d9113d03ed50de202d

SHA256
2efd18bd4784383001999a4c15aad7724fae01db9413c5abb60bd88a44753384

SHA512
286bef7340371bc2b02ec852459a055a0a197aa35e1bf443fa83fa9a407e566181bd697bb96b24f53111ae03babd7bbff72fdbea56469c8797a0ecf227c9b5c8

Download Submit
memory/396-138-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/396-137-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/396-133-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/396-139-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/396-140-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/396-141-0x0000000001000000-0x0000000001B7B000-memory.dmp

Filesize
11.5MB

Download
memory/396-136-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/396-135-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/396-134-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/2536-158-0x0000000001420000-0x0000000001421000-memory.dmp

Filesize
4KB

Download
memory/2536-162-0x0000000001460000-0x0000000001461000-memory.dmp

Filesize
4KB

Download
memory/2536-163-0x00000000003C0000-0x0000000000F3B000-memory.dmp

Filesize
11.5MB

Download
memory/2536-161-0x0000000001450000-0x0000000001451000-memory.dmp

Filesize
4KB

Download
memory/2536-160-0x0000000001440000-0x0000000001441000-memory.dmp

Filesize
4KB

Download
memory/2536-159-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/2536-157-0x00000000013F0000-0x00000000013F1000-memory.dmp

Filesize
4KB

Download
memory/2536-156-0x00000000013E0000-0x00000000013E1000-memory.dmp

Filesize
4KB

Download
memory/2536-155-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing