laplas | 58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066

General

Target

58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe
Size

726.3MB
MD5

6b35f9b0924ad5d06b67ae796866f4a4
SHA1

cf7cce459735708e09774f1c1cf0453bb8819050
SHA256

58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066
SHA512

3dd02c01e413a71fdb5ba11a6c6de040ede2e752ca7c200e525ee1bb344104f1746039463762c8ff0e0f7225ec61dc1f4c21b60b03372aaca65cfdf0975ff42a
SSDEEP

196608:vggQ0My1ifzmsCWZ1iQCzJw5POLQNocTRlz5:HF1GzDD1C1nENo+Rlz5

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://212.113.106.172

Attributes

api_key
a8f23fb9332db9a7947580ee498822bfe375b57ad7eb47370c7209509050c298

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Executes dropped EXE 1 IoCs

Processes:

svcservice.exe

pid process

2132 svcservice.exe

pid	process
2132	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exesvcservice.exe

pid	process
1028	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe
1028	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe
1028	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe
1028	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe
2132	svcservice.exe
2132	svcservice.exe
2132	svcservice.exe
2132	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe

description	pid	process	target process
PID 1028 wrote to memory of 2132	1028	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe	svcservice.exe
PID 1028 wrote to memory of 2132	1028	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe	svcservice.exe
PID 1028 wrote to memory of 2132	1028	58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe	svcservice.exe

C:\Users\Admin\AppData\Local\Temp\58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe
"C:\Users\Admin\AppData\Local\Temp\58d5961b14543a6b7aceb00365f017fd76083734d4c22b4a3bb8d4690396a066.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6CI3IN3W\regex[2].txt
Filesize
633B

MD5
c5298d2c78be8fdfc264eb6fe3e275f8

SHA1
f09de5f443da081efaff0155f422ca0375edd164

SHA256
de32b3c0549fde0dc5ac435a89f16a87832a0632b6602e75f552d07074081577

SHA512
5aeb5013b00e13cd8a172639bc7c675bd06cc0473ae9844c9c324e5c322987ddeff986bd4a8e620ce0ca9d1098a3ee8bbb4802789d1e89b0ec0cecf2f55a4853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6RO0PN6W\online[2].txt
Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Filesize
1554.3MB

MD5
56b96dec43665ef4dd358178190fcd5e

SHA1
ddcae00776fb8540b06bc368cb8da5b605792276

SHA256
c9a39d64e30a619e9ceb9925b6e1b44064d160651d22345af5308ebbfd5f7bcd

SHA512
6db089df252a1c40cad161ffc3352f26edc31641a2a5fc3320c39f9e710d9b0abd6d4836b202597b8dd3e03b5d3b5fa3e499637d3f76a01d30bccaab4b2de418

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
Filesize
1554.3MB

MD5
56b96dec43665ef4dd358178190fcd5e

SHA1
ddcae00776fb8540b06bc368cb8da5b605792276

SHA256
c9a39d64e30a619e9ceb9925b6e1b44064d160651d22345af5308ebbfd5f7bcd

SHA512
6db089df252a1c40cad161ffc3352f26edc31641a2a5fc3320c39f9e710d9b0abd6d4836b202597b8dd3e03b5d3b5fa3e499637d3f76a01d30bccaab4b2de418

Download Submit
memory/1028-125-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/1028-123-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/1028-127-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/1028-128-0x0000000000400000-0x0000000000DE8000-memory.dmp

Filesize
9.9MB

Download
memory/1028-121-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1028-124-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/1028-122-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1028-126-0x0000000002C80000-0x0000000002C81000-memory.dmp

Filesize
4KB

Download
memory/2132-139-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/2132-141-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/2132-142-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/2132-143-0x0000000000400000-0x0000000000DE8000-memory.dmp

Filesize
9.9MB

Download
memory/2132-140-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/2132-138-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads