laplas | ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8

General

Target

ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe
Size

726.7MB
MD5

bbd00ec4e0a57e9c3bc8b57c6d22e4ac
SHA1

c0463ce8ef9dcf563e4321ffcdf86ca4ee2a8b97
SHA256

ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8
SHA512

178017fb9fd541aba2d342829c0f81411d334b826eb0a003a4654734bfb58364b6e130f749454d32b61e2a55a8e552a9986fece6b1db34ed18396c27c84c9419
SSDEEP

196608:iZ+oLduGqM8p7XZoYAc7EMFxDx3AztxcMl6h5K2yEfZ:a+oLduGh8p7XZlFxDUvcMl6h5JyEx

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://212.113.106.172

Attributes

api_key
a8f23fb9332db9a7947580ee498822bfe375b57ad7eb47370c7209509050c298

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
4112	svcservice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4036	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe
4036	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe
4036	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe
4036	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe
4112	svcservice.exe
4112	svcservice.exe
4112	svcservice.exe
4112	svcservice.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4112	4036	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe	66
PID 4036 wrote to memory of 4112	4036	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe	66
PID 4036 wrote to memory of 4112	4036	ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe	66

C:\Users\Admin\AppData\Local\Temp\ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe
"C:\Users\Admin\AppData\Local\Temp\ef459820a29f16850147c08c143b76a58990c1813edaaf5bfad20aa05e65a4d8.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6CI3IN3W\regex[2].txt

Filesize
633B

MD5
c5298d2c78be8fdfc264eb6fe3e275f8

SHA1
f09de5f443da081efaff0155f422ca0375edd164

SHA256
de32b3c0549fde0dc5ac435a89f16a87832a0632b6602e75f552d07074081577

SHA512
5aeb5013b00e13cd8a172639bc7c675bd06cc0473ae9844c9c324e5c322987ddeff986bd4a8e620ce0ca9d1098a3ee8bbb4802789d1e89b0ec0cecf2f55a4853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6RO0PN6W\online[2].txt

Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
1476.7MB

MD5
69531e25ef69227a12024c61e8018c9c

SHA1
a789f2a3d7885aee28351c7a0e0e946ff42a5cb8

SHA256
309ab8b3c92846ebc6d865aae7de8354fc5ef68ad736a68ea04a12fc5903d8fd

SHA512
6ee63283fe9fc670510fbc91fb174bd14cde09c77f8ccef988dfb3d5eacb08e6210ddd6c23dba8136836e63495e4d01fb5cc597aa77049c3ee8309c57dd8e446

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
1476.7MB

MD5
69531e25ef69227a12024c61e8018c9c

SHA1
a789f2a3d7885aee28351c7a0e0e946ff42a5cb8

SHA256
309ab8b3c92846ebc6d865aae7de8354fc5ef68ad736a68ea04a12fc5903d8fd

SHA512
6ee63283fe9fc670510fbc91fb174bd14cde09c77f8ccef988dfb3d5eacb08e6210ddd6c23dba8136836e63495e4d01fb5cc597aa77049c3ee8309c57dd8e446

Download Submit
memory/4036-122-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/4036-123-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/4036-124-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/4036-125-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/4036-126-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/4036-127-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/4036-128-0x0000000000C90000-0x0000000001731000-memory.dmp

Filesize
10.6MB

Download
memory/4036-121-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4112-137-0x0000000001C60000-0x0000000001C61000-memory.dmp

Filesize
4KB

Download
memory/4112-139-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/4112-140-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/4112-141-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/4112-142-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/4112-143-0x0000000000D40000-0x00000000017E1000-memory.dmp

Filesize
10.6MB

Download
memory/4112-138-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/4112-136-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing