laplas | d6bded6019229818ccf6ee5bb74dd5eb73cbe05ccadd30793e31ea7393738d9f

General

Target

d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe
Size

7.2MB
MD5

79f92f15ae5abceeaf487bf041aec54d
SHA1

05cd320d0a7f52a3511c05e54360d4512fd4da57
SHA256

d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14
SHA512

36c65db2149eb8b43356982533e79749a715174cf220ae519861117eaebd239531b4dc6a6db303d06171dd43d2d4371d6be40b7ea6a1cf590d7f919f2148431f
SSDEEP

196608:TOZKfeUTUAYVz1ayJz2kzxXuzg6CF9X2G:TYKmUzaz1BJ2oxXAg6CLX

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes

api_key
282dad126e565baaaf231822cab8d693912f9b76b528a6f568b2bac069b49e61

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe

Executes dropped EXE 1 IoCs

pid	Process
624	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1796	d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe
1796	d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe
624	svcservice.exe
624	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 624	1796	d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe	84
PID 1796 wrote to memory of 624	1796	d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe	84
PID 1796 wrote to memory of 624	1796	d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe	84

C:\Users\Admin\AppData\Local\Temp\d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe
"C:\Users\Admin\AppData\Local\Temp\d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
782.2MB

MD5
48559086e3014567313af519fc32ed66

SHA1
f536d4fa3fb9331caa81cd3cd50bac880a5d7c40

SHA256
31675a936cbee1d7d927c626d75bf6c7e03007cf9c3edd3e1bc1bfee6898d09d

SHA512
5aad848ce96ba7a77d60ffb9ce67cd5b57d783408b78fea50a6d5e83507b9e348e61499423c0b866a6f39b2aadf6ed8b08f50f10d9ee5aa51f55a7a90bc9ec08

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
782.2MB

MD5
48559086e3014567313af519fc32ed66

SHA1
f536d4fa3fb9331caa81cd3cd50bac880a5d7c40

SHA256
31675a936cbee1d7d927c626d75bf6c7e03007cf9c3edd3e1bc1bfee6898d09d

SHA512
5aad848ce96ba7a77d60ffb9ce67cd5b57d783408b78fea50a6d5e83507b9e348e61499423c0b866a6f39b2aadf6ed8b08f50f10d9ee5aa51f55a7a90bc9ec08

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
754.3MB

MD5
3681860a850011ad120f82287a272f4f

SHA1
7644b64bc3087507f20f06b05394e5b332c58004

SHA256
e3855536ac0e238ca21d120abd61b668da77f26d844a6a71f4b6538aa9cc8130

SHA512
9fcc8e6391d5c0ed6f3c30da8b0d8f0fd022465d3779f19dca48449408d54577639853f9626b4a20d2545d70f210d63529bcf792b3697d7879de5fd3275d4a0a

Download Submit
memory/624-155-0x0000000001C10000-0x0000000001C11000-memory.dmp

Filesize
4KB

Download
memory/624-154-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/624-161-0x0000000000C40000-0x000000000176B000-memory.dmp

Filesize
11.2MB

Download
memory/624-160-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/624-158-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/624-159-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/624-157-0x0000000001C80000-0x0000000001C81000-memory.dmp

Filesize
4KB

Download
memory/624-156-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/1796-140-0x00000000004F0000-0x000000000101B000-memory.dmp

Filesize
11.2MB

Download
memory/1796-133-0x00000000014E0000-0x00000000014E1000-memory.dmp

Filesize
4KB

Download
memory/1796-134-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1796-135-0x0000000001500000-0x0000000001501000-memory.dmp

Filesize
4KB

Download
memory/1796-136-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/1796-137-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/1796-139-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/1796-138-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing