laplas | b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769

General

Target
jaffacakes118_b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769.exe
Size 8KB
Sample261016-jp4bcabv7s
SHA256 b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769
MD5 fd91151e7f28465aa907ddfc27b4f2f5
SHA1 bdb6dcbef19ca824735b114d309120c97a2583da
SHA512 feb62c6f0322be6bd3aeb56d74767385b90395c64991ba7f5fcfc0364d3e0f77c3f7449e94a6bb6dba40a37729a2dcccd28811b46bc7433cd5b617185c33e799
SSDEEP 96:tZNNWTSjhN5XK0N0mo8mez+vsxXaZ4BAdZ+nCgNdZlVgu8TsP0M:+Wc0N7bBLC6hgA
TLSH
T1BFF1E7167BD55225C7AF077C847343114F32BB62A222C62F2CDC926D6CA2FC84B017EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper discovery execution laplas persistence stealer

Malware Config

Extracted

Family

laplas

C2

clipper.guru

Attributes

api_key
d3bce09c5961a898f079f77978bcaecea30c9172b520f467e4faa82cf9ab7ef4

Signatures

Family: Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 4 IoCs

pid	Process
4804	svcupdater.exe
4588	svcupdater.exe
6116	svcupdater.exe
1912	svcupdater.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1124	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svcupdater.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2436	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	jaffacakes118_b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769.exe
Token: SeDebugPrivilege	4804	svcupdater.exe
Token: SeDebugPrivilege	4588	svcupdater.exe
Token: SeDebugPrivilege	6116	svcupdater.exe
Token: SeDebugPrivilege	1912	svcupdater.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 1124	3484	jaffacakes118_b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769.exe	90
PID 1124 wrote to memory of 2436	1124	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C schtasks /create /tn \dtc8l4kufi /tr "C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \dtc8l4kufi /tr "C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2436

C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe
C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe
"C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe
"C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe
"C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\dtc8l4kufi\svcupdater.exe
Size 8KB
SHA256 b3000ed26710a73a964d7444d669649eb7cea235b7993aafd57b09fdab74e769
MD5 fd91151e7f28465aa907ddfc27b4f2f5
SHA1 bdb6dcbef19ca824735b114d309120c97a2583da
SHA512 feb62c6f0322be6bd3aeb56d74767385b90395c64991ba7f5fcfc0364d3e0f77c3f7449e94a6bb6dba40a37729a2dcccd28811b46bc7433cd5b617185c33e799
SSDEEP 96:tZNNWTSjhN5XK0N0mo8mez+vsxXaZ4BAdZ+nCgNdZlVgu8TsP0M:+Wc0N7bBLC6hgA
TLSH
T1BFF1E7167BD55225C7AF077C847343114F32BB62A222C62F2CDC926D6CA2FC84B017EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3484-0-0x00007FF9FA7DF000-0x00007FF9FA7E0000-memory.dmp

Download

memory/3484-1-0x0000000000290000-0x0000000000298000-memory.dmp

Download

memory/3484-2-0x00007FF9FA650000-0x00007FF9FAFF4000-memory.dmp

Download

memory/4804-4-0x00007FF9FA650000-0x00007FF9FAFF4000-memory.dmp

Download

memory/4804-5-0x00007FF9FA650000-0x00007FF9FAFF4000-memory.dmp

Download

memory/4804-6-0x00007FF9FA650000-0x00007FF9FAFF4000-memory.dmp

Download

memory/4804-7-0x00007FF9FA650000-0x00007FF9FAFF4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads