laplas | a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df.exe
Size 4.8MB
Sample261016-jjp7jat19l
SHA256 a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df
MD5 370d634ba42930998329a6f08432e9e8
SHA1 40c9579d9d6150bce086d00a3ecc0751779b9dca
SHA512 23475d2b7bf6279a5adfc0802f057636d0825d71a9b394a5fefa6e09e69535e23585f80eb1084a782a612fe45733fae583168b0bea8a693b515f5d63d19a197e
SSDEEP 49152:SAMKyiGxtRJHH5VFmJgBaShRgpCMYh4fFvL9Xq+mbtXTC60HjGS5g+A:dMQGxtxVFmJgXxl4dv0b1+I+A
TLSH
T1A0364B17FCA214F9D5BEF13086529322BAB178A943303BD35F9496691A26FD0BB3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper discovery execution laplas persistence stealer

Malware Config

Extracted

Family

laplas

clipper.guru

Attributes

api_key
be8b883b0f281dda9a96404db70e3988b9c0bec8ec0ad6fca6a9f03ba18c595a

Signatures

Family: Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 3 IoCs

pid	Process
4656	svcupdater.exe
1688	svcupdater.exe
3296	svcupdater.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3280	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svcupdater.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4748	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3280	1536	jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df.exe	85
PID 3280 wrote to memory of 4748	3280	cmd.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\cmd.exe
  cmd.exe "/C schtasks /create /tn \xoqFQOSdCP /tr \"C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \xoqFQOSdCP /tr \"C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4748

C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe
"C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4656

C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe
C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe
C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe
1⤵
- Executes dropped EXE
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZPGXkxFvKy.pid

Path C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\ZPGXkxFvKy.pid
Size 4B
SHA256 15e455ddba0cbf83d388c148ee404c9ae0ac4ebf66abb7c65da36a554a85ac71
MD5 55563844bcd4bba067fe86ac1f008c7e
SHA1 d8356d4de0b9c2106bcb2eb068937a5b0788e0c5
SHA512 626064ac090d83427745ac3cce73a18b4196277e5f9c9ab2c3e54c7d11df434aef433d01fc3e616983c8dff88db1d297a6c09d1d63a980bee23e39bb359f481b
MD5 SHA1 SHA512

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\xoqFQOSdCP\svcupdater.exe
Size 4.8MB
SHA256 a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df
MD5 370d634ba42930998329a6f08432e9e8
SHA1 40c9579d9d6150bce086d00a3ecc0751779b9dca
SHA512 23475d2b7bf6279a5adfc0802f057636d0825d71a9b394a5fefa6e09e69535e23585f80eb1084a782a612fe45733fae583168b0bea8a693b515f5d63d19a197e
SSDEEP 49152:SAMKyiGxtRJHH5VFmJgBaShRgpCMYh4fFvL9Xq+mbtXTC60HjGS5g+A:dMQGxtxVFmJgXxl4dv0b1+I+A
TLSH
T1A0364B17FCA214F9D5BEF13086529322BAB178A943303BD35F9496691A26FD0BB3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads