Malware Analysis Report

2025-06-16 04:57

Sample ID 230317-25t2qaad27
Target fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4
SHA256 fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4
Tags
laplas clipper discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4

Threat Level: Known bad

The file fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4 was found to be: Known bad.

Malicious Activity Summary

laplas clipper discovery persistence spyware stealer

Laplas Clipper

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Enumerates physical storage devices

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

GoLang User-Agent

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-17 23:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 23:10

Reported

2023-03-17 23:12

Platform

win10v2004-20230220-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1300 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe C:\Windows\SysWOW64\cmd.exe
PID 3340 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3340 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3340 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2904 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe
PID 2904 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe
PID 2904 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe
PID 3704 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 3704 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 3704 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe

"C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fd82f497d37d39f0bdc6db9a32f6474d1820327a5de1d8dc1dd0fd7274caace4.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe

"C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
LV 45.87.154.30:80 45.87.154.30 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 30.154.87.45.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 210.81.184.52.in-addr.arpa udp
N/A 185.119.196.167:80 185.119.196.167 tcp
US 8.8.8.8:53 167.196.119.185.in-addr.arpa udp
US 8.8.8.8:53 36.146.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 113.238.32.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
LV 45.87.154.105:80 45.87.154.105 tcp
US 8.8.8.8:53 105.154.87.45.in-addr.arpa udp
US 52.152.108.96:443 tcp
US 8.8.8.8:53 55.154.139.52.in-addr.arpa udp
US 209.197.3.8:80 tcp
NL 8.238.177.126:80 tcp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp

Files

memory/1300-134-0x0000000002B70000-0x0000000002B85000-memory.dmp

memory/1300-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/1300-205-0x0000000000400000-0x0000000002AFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe

MD5 2bf7a5a8fa98cc72f6953c835531f651
SHA1 284871c67b96e46064c1529119801e26e065efe3
SHA256 f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213
SHA512 38880e544b3359abbec5b7da0573d1c5371d274bae90a4541a79b590c75a5c1ecd3e15b77a937c10c0942842634a3f6b4063a4c182f91526f7f33cc790994fbe

C:\Users\Admin\AppData\Local\Temp\AEHDAKFIJJ.exe

MD5 2bf7a5a8fa98cc72f6953c835531f651
SHA1 284871c67b96e46064c1529119801e26e065efe3
SHA256 f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213
SHA512 38880e544b3359abbec5b7da0573d1c5371d274bae90a4541a79b590c75a5c1ecd3e15b77a937c10c0942842634a3f6b4063a4c182f91526f7f33cc790994fbe

memory/3704-210-0x0000000004B90000-0x0000000004F60000-memory.dmp

memory/3704-212-0x0000000000400000-0x0000000002C8F000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 ae3fd6b0fd2fc1c899815ead54d776fc
SHA1 44882d8e080624250267b81075b7efcaddd4b0e7
SHA256 0aeb71d5879fb398931b3e70a2dfc68b25e8810bd8e73eb8441da150f17a7984
SHA512 5006a3be8d430f8488914d56cfa4e1e6af960ac548a4a74518fce7791c2dba141c60159115d1050dff7484e3bff89065704363c829f2322a3bc8a7b82220b06e

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 ddb727c2f3217e95953881ce5e23ae11
SHA1 500d3bfc22e0dd874ba5cb555fe4016f2776bda8
SHA256 3a3d11be21a0c5154f99ce6cc1dc169978fa184b328b7ab70b9720f442eb6429
SHA512 1eb5ad2360d1863b24dd965e298648d258bb93c83b743cb8bd420154a8acbb0ad78b887ffb7e3965900e750ba2cacbe81ca17e3e4b22024011f28a39c2a9700c

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 61468958d1edb0fad504ba6d6499c0a1
SHA1 3d546257ddc41e4202b642dbd668af6ff03d0253
SHA256 b54044810d7fe44aa6026f6312ff7f630ef501d567fdcfa8998908a314d8feec
SHA512 78cd340218f618b7cb9ae876ee9dd51c85d3fb18073ce5c5b9bd5c0f38a753e37343e39fa6d20b919069941f68b474986d45c51d71533aa0171f47fde1c3c7af

memory/3704-215-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-218-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-219-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-221-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-222-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-223-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-224-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-225-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-226-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-227-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-228-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-229-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1412-230-0x0000000000400000-0x0000000002C8F000-memory.dmp