laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
31s
max time network
143s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-05-2023 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1196	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2044	conhost.exe
2044	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1196	2044	conhost.exe	28
PID 2044 wrote to memory of 1196	2044	conhost.exe	28
PID 2044 wrote to memory of 1196	2044	conhost.exe	28

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
459.2MB

MD5
23497d7dbf245fdc670851f7939c1d9a

SHA1
67ee731f5401c52d837e1a7c8f7b44ddd289eda2

SHA256
cda391288e580a2a60bd6e4ffceab676b7ff395519b72ad764f6b5a90dce8244

SHA512
7c693b2bb2e9b59a78de6db30627bee44881eca1e5f5dc6c06fc6bfbc8046e92699c029db664d9e21f7cc6ff690fdfb52cdb8c55a03f8822f1a5650f4719e808

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
390.4MB

MD5
343a57895189b204305e9644bc225c77

SHA1
145d0a52c98fcad79357798583487b66195ab834

SHA256
9f029e4871187dc2c9839f49c63a4553fb2fe5de93afe89768bc50eae26aa748

SHA512
8cda91550175695269e44bb8e389d89db2950e0db6e69032d76d1e6dbb2c145f95507bbd95506316966c39c8d1eeaa3faf74835c1f642eeeb28cde901cc7878f

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
381.7MB

MD5
ce610f92af5f921d93666dce7e20b26b

SHA1
f1458a1fe566f715e4d3ad15e7e2ef8cacc12fca

SHA256
7fb12f305c4403a9037b0119724914ee5fa19cc8069398b6039ba0eb4ac97fdb

SHA512
d94001dc462db1e79934049fd32af29b9d189189c581e2d4b028be3c70c0906d901da798b8ee5d1ec03bb33e01b61a2d870b037f4de035c9f92d59b4133c840b

Download Submit