laplas | 14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320

Analysis

max time kernel
30s
max time network
142s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.0MB
MD5

feccda803ece2e7a3b7e9798714ad47e
SHA1

e97182adccf8a7692e6ad2614b0fb7fd3898a1a2
SHA256

14529dca41abfea65abb51c84ec34ba0a951581586f98cef60213ae949a78320
SHA512

dec5fd4d184772ca590333b2382706c6e5a7b5050f9ae98af813192e06500424870e8332a1406c763e5cc6d266ddd7e09280b6bf118392fa6edea6fab5843287
SSDEEP

49152:jEjwvlIKv05z+UERnIcYmWjc3Cdh+5E9UFiqeb0/B1:RlhWzZ6hjEciqe

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

http://185.223.93.251

Attributes

api_key
f0cd0c3938331a84425c6e784f577ccd87bb667cfdb44cc24f97f402ac5e15b7

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Executes dropped EXE 1 IoCs

pid	Process
1200	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1132	conhost.exe
1132	conhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1200	1132	conhost.exe	28
PID 1132 wrote to memory of 1200	1132	conhost.exe	28
PID 1132 wrote to memory of 1200	1132	conhost.exe	28

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
746.2MB

MD5
22c1e7b25fb2bd7064b0ff5a8b7e0f84

SHA1
5cfa2e4c5424c3aa93b7c341ceda7dfbd78a21a3

SHA256
1f4f89df4a56ab8c65e1e5a7ddf13895c0a9be8a3eb28e35b63c00fb5a5c50aa

SHA512
70314581b4d86a7b9978351d9c98d4014b3aade0d4d403d4402440d227c4b1c13d9628ccb4e3708069ec9b424f63b4daf6d2a5e12023932664991070e0f3db99

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
736.9MB

MD5
dba830faed144846cf99c542565eff87

SHA1
cb3ac5f9f10dac6613354b65002481afc85a762d

SHA256
fe302b769975e201f37be393bc855c2035bf260569caa1f1dbad818ffa80d643

SHA512
fe653522138d77752c0a9483e300909aa95a9b5c30c7fb5a56c6acd002834609a1c03381a278c6283fd48ba6f6bf4dfe6ca8c0087b1cce7865bcf1dcdac8da52

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
750.8MB

MD5
63ff47c5a11cdb312c67b73af9977c2f

SHA1
400d63b57bfea17660967b27a66210e4465c1083

SHA256
7e94f9251a27e6994fadf4f52c8800868bb5326f88733b28dbf9694b3b692950

SHA512
a949f1183bb52333b56b4d99a0403b4c48b6800edeec4627a38f15ff11481b48644f7c20cb74f53534850208b03d17cb4f82eece3b2419594c1994e54eca6a53

Download Submit