Malware Analysis Report

2025-06-16 04:57

Sample ID 230317-x2bzhsbf8t
Target 857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a
SHA256 857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a
Tags
laplas clipper discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a

Threat Level: Known bad

The file 857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a was found to be: Known bad.

Malicious Activity Summary

laplas clipper discovery persistence spyware stealer

Laplas Clipper

Downloads MZ/PE file

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

GoLang User-Agent

Delays execution with timeout.exe

Checks processor information in registry

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-17 19:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 19:20

Reported

2023-03-17 19:23

Platform

win10v2004-20230220-en

Max time kernel

144s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1148 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2796 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2796 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4704 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe
PID 4704 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe
PID 4704 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe
PID 1980 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 1980 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 1980 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe

"C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\857e87bd5f7ecb3015f37aa14f25c34a0f07aa49c86e02439c2710b241f84c3a.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1148 -ip 1148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 2140

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe

"C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
LV 45.87.154.30:80 45.87.154.30 tcp
US 8.8.8.8:53 30.154.87.45.in-addr.arpa udp
US 8.8.8.8:53 36.146.190.20.in-addr.arpa udp
US 8.8.8.8:53 199.176.139.52.in-addr.arpa udp
US 8.8.8.8:53 113.238.32.23.in-addr.arpa udp
N/A 185.119.196.167:80 185.119.196.167 tcp
US 8.8.8.8:53 167.196.119.185.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
LV 45.87.154.105:80 45.87.154.105 tcp
US 8.8.8.8:53 105.154.87.45.in-addr.arpa udp
IE 20.54.89.15:443 tcp
US 20.189.173.4:443 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 117.18.237.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp

Files

memory/1148-134-0x0000000004830000-0x0000000004845000-memory.dmp

memory/1148-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/1148-205-0x0000000000400000-0x0000000002AFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe

MD5 bffa52b5cf6599656807cd59666821d4
SHA1 a5b4f03c320488e0c616c7070166c3eccfe235c3
SHA256 a79893e20ce928c0dee25e1f6d64f7e88cdf7cf0db83e923decd0bf643f0f951
SHA512 6cc12e483dfb8e6680621fc5536158211c26ab82191db935731c3667a3c44c135edb34ec10809bb4a1ec8007eac8f2af424e130d8810ed34370ef9b9a9fa94c8

C:\Users\Admin\AppData\Local\Temp\AKEGDHJDHD.exe

MD5 bffa52b5cf6599656807cd59666821d4
SHA1 a5b4f03c320488e0c616c7070166c3eccfe235c3
SHA256 a79893e20ce928c0dee25e1f6d64f7e88cdf7cf0db83e923decd0bf643f0f951
SHA512 6cc12e483dfb8e6680621fc5536158211c26ab82191db935731c3667a3c44c135edb34ec10809bb4a1ec8007eac8f2af424e130d8810ed34370ef9b9a9fa94c8

memory/1980-210-0x0000000004AF0000-0x0000000004EC0000-memory.dmp

memory/1148-211-0x0000000000400000-0x0000000002AFA000-memory.dmp

memory/1980-213-0x0000000000400000-0x0000000002C8F000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 bc7ca0a31c1f0c58cf283e6cb942abbe
SHA1 765776b1c81933b55721f04c7982c007f3f6f2b1
SHA256 7fc39a1c6bb66d5bf7d006a7170e43b561ac2c9e6a44715a0e07b8a822376c45
SHA512 730d256c0915364fd9c00b073341124cb978c846f25a32c36e0a734d73bcb1fadf2363a1e4c7f00c0e3b7aa95fd0ad1cf2f3f4630a271498e5490710d3bc08f1

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 c254c4b599025bf2dfb8c147f98dae57
SHA1 6b44dd32aeedfc77fd5eeb4946e332e7e9477057
SHA256 5c4fa44098fa43cef9c9e9520c7cacd06d6c13c441217d36ca9c3f8331f20c0d
SHA512 56b8d4861cdf013ab37272c116309cd6f57b5e5248e1849f11620d94a6ecb735b12ba88d5a671fa2a8c69b52e7829ce30f685c49bfba472b15e8a4cad53967da

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 4c18118a075446a0d825a3ee48c436fb
SHA1 d8b0fe03de03794ee929b1dceb63ef28b30b8616
SHA256 596a4f3aa9033993f811c0aa2267c8a772f200659c8bc914c79ada78771b3706
SHA512 d08c9e7948202e6da0e4e67917b2892e6c510cc24cc8ae3d5035ed4d12e0099ff9649b4b096f62a6da1b8f53419f51c7ec0a7e522a53e826aa2dfa48f6772300

memory/1980-215-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-219-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-220-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-222-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-223-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-224-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-225-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-226-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-227-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-228-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-229-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/216-230-0x0000000000400000-0x0000000002C8F000-memory.dmp