laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
31s
max time network
142s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-05-2023 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2012	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1092	conhost.exe
1092	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2012	1092	conhost.exe	28
PID 1092 wrote to memory of 2012	1092	conhost.exe	28
PID 1092 wrote to memory of 2012	1092	conhost.exe	28

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
669.5MB

MD5
decdc3a08ecf6d3cb56dfee42fe24961

SHA1
637790fc003d25f1b9daaa5ff2a633ca47436946

SHA256
d0c8ca5e6488f185ade58a9ab76dedd1b6a2ce5c36660efe89ed12ff962c9c60

SHA512
1e4bc6f741cec3e85a6be77e8d4bd9220041f97618aa1ace3ac7fb1a1233d5b69fb3711f2d52cad851adb83092759425df8c5de1b3a9b34acad1abe8a1c8cfd3

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
656.4MB

MD5
b7791cebb146acb0aa986633a7ca3eb0

SHA1
6436c0ac6c080753d0c9aa177711d05a1ac5a783

SHA256
25ba0511fb6d5a35324cff1df8d65d59288718cb01aed2d12f61f2a551c06d1e

SHA512
9fbf66f10f59624e08a3a015b6055cf0748f9604b2815e48371883642ef9b44455ab34c0e8a0a873f007bea74df272b49bb6d16fa89479f946f25e6f785e4c05

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
619.4MB

MD5
a1e8643ebcc4a8b2dc37738ad51940e6

SHA1
4578aaf0ac5be7415f2e0c65417c64f85a7da2ab

SHA256
4f3031593703663f53ce681d5a04dcf684c362fce34ee91b4b3d8b89dc6ee39a

SHA512
1220d78e0badd8d9c5912357bd34b9edb72d1f2a324a022cf18ce5a6d8baadf96aa92fde41d9cd8a7e7cf3ad2776cefc6e1534bf169d1698796b3a668903e859

Download Submit