laplas | a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a

General

Target

a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
Size

727.1MB
MD5

6804b55133ae5596dbe5f66dadbf2b6c
SHA1

e86f29cab01ff8e8aa3c2b6eaf6ebed92b548d55
SHA256

a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a
SHA512

1735412f459375a393c0a3da305fcdcae961d9b4ba16fbf521ec7af1b9521ab637404c95362abc19cefc77ba726083430ac37280e976588bd0874e24e9276543
SSDEEP

98304:/+l8XYIVemDeKL2VfHg3spY6hqLgE9ywuFtA40s/sTr0DfxxSJZfpqbTU7VZd6H3:l/ftL2f+6MLr0wsf0HTr0D5mmGdbe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://212.113.106.172

Attributes

api_key
a8f23fb9332db9a7947580ee498822bfe375b57ad7eb47370c7209509050c298

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
3868	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
3868	svcservice.exe
3868	svcservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
3868	svcservice.exe
3868	svcservice.exe
3868	svcservice.exe
3868	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3868	5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe	66
PID 5104 wrote to memory of 3868	5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe	66
PID 5104 wrote to memory of 3868	5104	a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe	66

C:\Users\Admin\AppData\Local\Temp\a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe
"C:\Users\Admin\AppData\Local\Temp\a9ba63a83e9b72084122461508f66d9a445093500396e02b67f1dcd7e052f15a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\online[2].txt

Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RIZDY293\regex[2].txt

Filesize
633B

MD5
c5298d2c78be8fdfc264eb6fe3e275f8

SHA1
f09de5f443da081efaff0155f422ca0375edd164

SHA256
de32b3c0549fde0dc5ac435a89f16a87832a0632b6602e75f552d07074081577

SHA512
5aeb5013b00e13cd8a172639bc7c675bd06cc0473ae9844c9c324e5c322987ddeff986bd4a8e620ce0ca9d1098a3ee8bbb4802789d1e89b0ec0cecf2f55a4853

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
1548.1MB

MD5
6483b8fcb3c7306fc79f192677bcf9ac

SHA1
d468a31ece9465ab3249564dd22e2bc3c643d896

SHA256
ce8cb6806d7ec1c26343571217ee2c7fc78d73a2b2b1e1597ef5f662ed01ba0d

SHA512
8e8a919b25a12b1d586b08e4346b9e5ec2d308994b9f88a4cf00c8d44996e9017e18e661399a1be1bde97afe7fe2d20a56184b7e99856c5f99897bc87056758b

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
1548.1MB

MD5
6483b8fcb3c7306fc79f192677bcf9ac

SHA1
d468a31ece9465ab3249564dd22e2bc3c643d896

SHA256
ce8cb6806d7ec1c26343571217ee2c7fc78d73a2b2b1e1597ef5f662ed01ba0d

SHA512
8e8a919b25a12b1d586b08e4346b9e5ec2d308994b9f88a4cf00c8d44996e9017e18e661399a1be1bde97afe7fe2d20a56184b7e99856c5f99897bc87056758b

Download Submit
memory/3868-137-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3868-136-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/3868-139-0x0000000000400000-0x0000000000B2B000-memory.dmp

Filesize
7.2MB

Download
memory/3868-138-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/3868-135-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/3868-134-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/3868-133-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/5104-120-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/5104-121-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/5104-125-0x0000000000400000-0x0000000000B2B000-memory.dmp

Filesize
7.2MB

Download
memory/5104-122-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/5104-117-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5104-124-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/5104-123-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/5104-119-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/5104-118-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing