laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
31s
max time network
142s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-05-2023 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2024	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1920	conhost.exe
1920	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2024	1920	conhost.exe	28
PID 1920 wrote to memory of 2024	1920	conhost.exe	28
PID 1920 wrote to memory of 2024	1920	conhost.exe	28

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
836.0MB

MD5
ecec444df8925662e7d937e5f05617bc

SHA1
dc8a37782c0a91aa8385714c509e1bb6359a426a

SHA256
eea3b9c490ef42af43d887141d96e5d6dcb758b4aa52121290c0f5380e38351a

SHA512
f187e6118f2d41f034417c461b3b69da785555f53b9702a7015ba3b7a1141926752e6d0f0a9362bcf4eed12bcaa0e66618ccad164d1b0b18e34b25c1aa0c2bf0

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
658.6MB

MD5
7d50ade864be229cac8114fb32792c40

SHA1
65844f28782850f8dc769f9ae6ed2235a3f4fa14

SHA256
23f173d0479383a72ae90691e779e35454c46574e823e0369ac79b1bc435c1be

SHA512
b212085525ceb23e471216ff329407a9e03a9b5b9e063bcff07a3bff4e628e8f3ba7e5a320d3f97598816b6a84fe2e2061bbfff595ccca93f840b6e26e8e89ee

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
636.3MB

MD5
f87dbe93b5a923c603f2f3c6d3f726b9

SHA1
a7bdda642190f764db6e3f2302ac12819131b285

SHA256
9d93aa5440a4245914ef2f6ca2f20b73ff6413d682abc3246a84258bdc811b60

SHA512
97602c1d9a971bc3b082704378e5a8bbcdd4f3a453a9c7c3205024c37794b91b32ec731593cb0d2b24d71500a6a5a4407aa20c0c286784c948c2c9a04d8d30c8

Download Submit