laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
30s
max time network
143s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-05-2023 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1248	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1100	conhost.exe
1100	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1248	1100	conhost.exe	28
PID 1100 wrote to memory of 1248	1100	conhost.exe	28
PID 1100 wrote to memory of 1248	1100	conhost.exe	28

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
666.1MB

MD5
99f2190700ec98ad56feda7a09d413de

SHA1
5d2a5edfb1de17e6342b6d8e4dfc4efdc08c5682

SHA256
265e031cfa8a772f4f632d2553e0354e40e8edec006109de9440ecf3140cb4af

SHA512
8da28c8b6b9d5580cbf16a741553ac8dafc56a2ff9f91cec85b7724759e7c6629c999d1a85e040d5652c94fee4dec8489224174b25be9e0d3d1284c6b659278d

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
705.0MB

MD5
6c47b2c19c7e2b64a65bca72357e0d28

SHA1
af2d34a14b17d9b2036b706ecd128504cc9876a6

SHA256
09abe64ba06d56b7ef96f9ee120579612b34ac4df0211b198b906b4254180a80

SHA512
c14a36d7550c0e47e2063e0b5b234cf335e6b25e62864cc23c8b6b01045a1f02ecce055833cd83537af560f12e151e9d275d184c9f1ec8bc575274af55e81022

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
677.2MB

MD5
0aae5168679c9689d529638a43f0a5eb

SHA1
9fb9bc7bdf244a76a7cbc2826f51f30998c29faf

SHA256
5cfe9a79e03a03dcc8b319ad15f3863acef7d60b33a706d94fe9e16da136f194

SHA512
10c0f1b7b2b766456b1aa3fad71b1d34549e643e083b943b9ab94eeb68e620b0cc6b0a65d8dc59db9d93638b7179fad5139a3da08f69c19dffd72f7450e77519

Download Submit