Analysis Overview
SHA256
78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b
Threat Level: Known bad
The file 78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b was found to be: Known bad.
Malicious Activity Summary
Laplas Clipper
Downloads MZ/PE file
Loads dropped DLL
Checks computer location settings
Reads user/profile data of web browsers
Executes dropped EXE
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Delays execution with timeout.exe
GoLang User-Agent
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-03-17 17:50
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-17 17:50
Reported
2023-03-17 17:52
Platform
win10v2004-20230220-en
Max time kernel
141s
Max time network
141s
Command Line
Signatures
Laplas Clipper
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" | C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe | N/A |
Checks installed software on the system
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
GoLang User-Agent
| Description | Indicator | Process | Target |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe
"C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\78b6dc966c04ef3a8e01b9e4af1cecb5d66c869a50c86cb7197555b1eeddab4b.exe" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1256 -ip 1256
C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe
"C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe"
C:\Windows\SysWOW64\timeout.exe
timeout /t 5
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 2104
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1648 -ip 1648
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 516
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| LV | 45.87.154.30:80 | 45.87.154.30 | tcp |
| US | 8.8.8.8:53 | 76.38.195.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.154.87.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.238.32.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| N/A | 185.119.196.167:80 | 185.119.196.167 | tcp |
| US | 8.8.8.8:53 | 167.196.119.185.in-addr.arpa | udp |
| IE | 20.54.89.15:443 | tcp | |
| US | 52.168.112.67:443 | tcp | |
| NL | 173.223.113.164:443 | tcp | |
| US | 8.8.8.8:53 | 1.77.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.97.242.52.in-addr.arpa | udp |
| NL | 8.253.208.113:80 | tcp | |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.97.242.52.in-addr.arpa | udp |
| LV | 45.87.154.105:80 | 45.87.154.105 | tcp |
| US | 8.8.8.8:53 | 226.101.242.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.154.87.45.in-addr.arpa | udp |
Files
memory/1256-134-0x0000000002DB0000-0x0000000002DC5000-memory.dmp
memory/1256-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
memory/1256-202-0x0000000000400000-0x0000000002AFA000-memory.dmp
memory/1256-204-0x0000000000400000-0x0000000002AFA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe
| MD5 | d433fee70e60de32de4608f07bed7d2a |
| SHA1 | 8b84224c8319705317340392ad99bc529183a7db |
| SHA256 | 0a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7 |
| SHA512 | ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8 |
C:\Users\Admin\AppData\Local\Temp\IJDBGDGCGD.exe
| MD5 | d433fee70e60de32de4608f07bed7d2a |
| SHA1 | 8b84224c8319705317340392ad99bc529183a7db |
| SHA256 | 0a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7 |
| SHA512 | ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8 |
memory/1256-211-0x0000000000400000-0x0000000002AFA000-memory.dmp
memory/1648-213-0x0000000002750000-0x0000000002B20000-memory.dmp
memory/1648-215-0x0000000000400000-0x0000000000803000-memory.dmp
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | fbded1c40623fc9b38b7d62c6c93c6b9 |
| SHA1 | 557386c3d28d93d19d9ec8c66f5a5006742b2e39 |
| SHA256 | cb0e66ee3a572aa5820ea2721e1f51b9da9156436a85f33698ad07ae7344646b |
| SHA512 | 7e2b9b920a2d96794507165d657ade929347bfbe15b5d1f5471d0313f1dd620b28820d6e9eba78505e0678adfb8e115a4cb43e8603b4038fc763002059075c34 |
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | 1b5b7080ee401a92d65163e153743a09 |
| SHA1 | 6e533b0d390df8a8d0d24e7dddaff5d2398b4cce |
| SHA256 | b5c8c535816ded1f128666cc69d28cec3cb621afade1a19964f02da606a2c808 |
| SHA512 | d1f777a05617edd0dc9f9edf28c5589b29e151635848fa5155e061a6ae4d13498cbda8dd0e70ed9bd051a99317f5fe57102abc3b4c209203d1b42452084f45b0 |
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | 5c83c07936caa7ab1205311dd3ba8696 |
| SHA1 | 405307b0646ac506a9045e25270276b4fa419597 |
| SHA256 | 616cd915e0d71c9963ea57a5d75ec7d5b99c694bd4da5a340ed54861015d5878 |
| SHA512 | aea25fbe5d9a6cfc22bc5c7208323d9c25552a2f123278d02f2900ce93af7c62fb26df2e3b3daac26aa771f4eebef5c13f8da791e765091d692e791fafe234b5 |
memory/1648-219-0x0000000000400000-0x0000000000803000-memory.dmp
memory/4912-221-0x0000000000400000-0x0000000000803000-memory.dmp
memory/4912-222-0x0000000000400000-0x0000000000803000-memory.dmp
memory/4912-223-0x0000000000400000-0x0000000000803000-memory.dmp
memory/4912-225-0x0000000000400000-0x0000000000803000-memory.dmp
memory/4912-226-0x0000000000400000-0x0000000000803000-memory.dmp
memory/4912-227-0x0000000000400000-0x0000000000803000-memory.dmp
memory/4912-228-0x0000000000400000-0x0000000000803000-memory.dmp