laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
29s
max time network
141s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-05-2023 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1692	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2040	conhost.exe
2040	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1692	2040	conhost.exe	28
PID 2040 wrote to memory of 1692	2040	conhost.exe	28
PID 2040 wrote to memory of 1692	2040	conhost.exe	28

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
778.0MB

MD5
952d9c2e2f9a0c7508bf1ad876c98196

SHA1
86876d6fc8deeb0039ee63d19582d257e2083ab7

SHA256
0ab3699d67f537ab60c451b9c4b5914f114e0a1a7a7d50154c2345f04b581603

SHA512
970ddc05777dadfccdf18c8c684f161e7bc7eee9970916296b6bdd2d96e1415f63f2727a56f166d3b1436791de3953d2e2b8e5a126b16566fd8e0ff4cc511c8a

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
630.8MB

MD5
1152ffe694090b6ce66d15f377cae6cc

SHA1
76b6e578085e7b762e83def76c9bb766cde068e5

SHA256
a52a4976be226ec8ad587d4801769189978ff6e822cc25f4cae5bb5f82b71655

SHA512
9f10b01d2479451b6f689d40f5d14fa801558d92dbcc09881e3f67fcbfc5b4e9fe17f0822a3bd302bd8cd9f88911d605b111b58cf5f46d407384e17085354f66

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
652.2MB

MD5
e4b1947014e5e34328a753357761eeb6

SHA1
27e9219552a1e2c54710d3f8f37dc8442a3f55dc

SHA256
e69ccf02ba8930e1082da74f99a25b04180febf5b2ea829161d203ea7e8c9938

SHA512
adce6a75058bf524b965751d6a8702de494aeb8c35eef05863e11a3d8fcb432d0d30d5fb2a4c06106070fe418461d81ab2d6dbcabb976d74a34f6135784f5351

Download Submit