laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
66s
max time network
140s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/05/2023, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1312	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1360	conhost.exe
1360	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1312	1360	conhost.exe	28
PID 1360 wrote to memory of 1312	1360	conhost.exe	28
PID 1360 wrote to memory of 1312	1360	conhost.exe	28

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
516.5MB

MD5
c41301387f5d3ff8843111ad93642204

SHA1
cb654ee8e22d20b3e747051517013ccd551ca563

SHA256
444bf938a8e9e757d1f70b41775ec14e22a92b35f7ae463d0bb7d58ec1ed219b

SHA512
e843b3caef0ba87e481640e7d95fda755a72579ce835e4b11d78346f853274f777ac91692310ef75907aa6e1e48eebd26fec93f78fea0557181d14f972f3aa3a

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
537.2MB

MD5
374d8bab280d513b7958878561283572

SHA1
a5eaba1d7772c7de47858fc9b9e6452907cc4dcb

SHA256
d3c2db4a090df51a3a477bd7d70ae5d656661301a7a586230bb21bcce50259be

SHA512
93d9eb109ea2750e5ebae71210548515aeda7fd6d77e796be8d2e2ef587f2ee5e397eb946878c19e1b1c3a33ebe4ffecfce792e19af9ead90d5c1bbaaa3e553b

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
520.0MB

MD5
c6d186fd1b2c6ba980f7b628e5b0417c

SHA1
08e03bc238a209a049f363aa42fd2c02fbbc7537

SHA256
65d84b7760751816e9cf8fca0de77d7b2de91875d490fa12b6a2c36dd56cfb5d

SHA512
aee5bbba931e4f038871a4a2d08c26cdf237f410a1cd8f9b5651016f4cb7f9655e6ecf5249389aea1752e09e5653da395d1951dce2e6feef9eac3c2be5f255e3

Download Submit