laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
30s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-05-2023 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
2012	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
828	conhost.exe
828	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2012	828	conhost.exe	26
PID 828 wrote to memory of 2012	828	conhost.exe	26
PID 828 wrote to memory of 2012	828	conhost.exe	26

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
417.6MB

MD5
19e87f854ddd3af919ae0b696ce540f9

SHA1
ede1523e930e389c803e271a16a7adf8990b5c38

SHA256
5097cd4e3a4dcfe64c31cba362b2a547b53900e754bb88460bbb8878e5a92594

SHA512
d8c09ccc672a52d36f2200b8a9091b0e79fe572c416006a8eeb94901670ad4f62ad12ccfe45d8bb4e8571e3ddc315e0cc398aea8b8173efd3d1f20a6c44d069d

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
415.2MB

MD5
8c80db817c76ceb120317c07197f269c

SHA1
2d5f6d7551a1978c42c2841fb43679cf3ffb2558

SHA256
aebd897291e78f2554c5075cc5eda349a05bcd2e05c44aca52c18b050e5eb2c5

SHA512
06b561785d45ace633f61fae44f9a160f17add966bafb2f6cc4ff0ddb6474856c8c7231e2863a272522725dafb633e770798962924f7bfef36ae55fdacafb48f

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
405.3MB

MD5
e36fb0d21113113211deca6c87560229

SHA1
9f583bb85471ccd9f3f0077870e60dba7d573732

SHA256
9b62883932a4edf81d3546328e6c418c0b94e4e782c3f752a6b8fd8156f6cd43

SHA512
6aecdecc07f21623114087906f9e89943c52ef5b9fdec3622cdbdaa00fc50ad9c5b3256c9f344b923646c54ea38954d7bc87ef1ea8895d8033c1a7a5ed0b26c7

Download Submit