Malware Analysis Report

2025-06-16 04:57

Sample ID 230317-y4qq5abh2x
Target 507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082
SHA256 507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082
Tags
laplas clipper discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082

Threat Level: Known bad

The file 507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082 was found to be: Known bad.

Malicious Activity Summary

laplas clipper discovery persistence spyware stealer

Laplas Clipper

Downloads MZ/PE file

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Checks processor information in registry

GoLang User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-17 20:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 20:20

Reported

2023-03-17 20:23

Platform

win10-20230220-en

Max time kernel

145s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4300 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4600 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4600 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1728 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe
PID 1728 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe
PID 1728 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe
PID 2668 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 2668 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 2668 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe

"C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe

"C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
LV 45.87.154.30:80 45.87.154.30 tcp
US 8.8.8.8:53 30.154.87.45.in-addr.arpa udp
N/A 185.119.196.167:80 185.119.196.167 tcp
US 8.8.8.8:53 167.196.119.185.in-addr.arpa udp
LV 45.87.154.105:80 45.87.154.105 tcp
US 8.8.8.8:53 105.154.87.45.in-addr.arpa udp
US 20.189.173.10:443 tcp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp

Files

memory/4300-121-0x0000000004810000-0x0000000004825000-memory.dmp

memory/4300-122-0x0000000061E00000-0x0000000061EF3000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4300-181-0x0000000000400000-0x0000000002AFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe

MD5 bffa52b5cf6599656807cd59666821d4
SHA1 a5b4f03c320488e0c616c7070166c3eccfe235c3
SHA256 a79893e20ce928c0dee25e1f6d64f7e88cdf7cf0db83e923decd0bf643f0f951
SHA512 6cc12e483dfb8e6680621fc5536158211c26ab82191db935731c3667a3c44c135edb34ec10809bb4a1ec8007eac8f2af424e130d8810ed34370ef9b9a9fa94c8

C:\Users\Admin\AppData\Local\Temp\IJDHDGDAAA.exe

MD5 bffa52b5cf6599656807cd59666821d4
SHA1 a5b4f03c320488e0c616c7070166c3eccfe235c3
SHA256 a79893e20ce928c0dee25e1f6d64f7e88cdf7cf0db83e923decd0bf643f0f951
SHA512 6cc12e483dfb8e6680621fc5536158211c26ab82191db935731c3667a3c44c135edb34ec10809bb4a1ec8007eac8f2af424e130d8810ed34370ef9b9a9fa94c8

memory/2668-186-0x0000000004A90000-0x0000000004E60000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 e90884dd794d3802e4e41d973d4f097a
SHA1 7358daef4e6038d65a1bfa30c2f88615914027f6
SHA256 024170cf550d318fb71a0349216072f4c544eb34023b71a747ef38f7735c7487
SHA512 262b28150ee42abc4452af199a98317f79a2e0b47903ace505e9407d190277bc025953a2359cef5c6a4c76199ede3c2fc0ca0724d8e8de3eb14928ee93b1ee9b

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 c978dca366954a1198f49443e29178fe
SHA1 7df5a6f05dc3e72969e718bd63440c5e72ab5475
SHA256 6e433e519e812c0507c6e9844ce4c9b2cc0cbd8195e609e7d9cf9032428fc3ab
SHA512 95a96db315ec42508b3a3dd8b08d34846a6f4f31eb3536356078a3fdb2f6ee297cc440f308d27319319402f3767bb6b48d03512e174bdc23a3581de89698c738

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 2cadb9713cd4fac58b00ddb1ed2ef858
SHA1 5a6b2c2de58ef66db4e3f0cf1eeedf103a9a4353
SHA256 2b34f78351a79c9482a3950363a936ab221fd8c5fe51f09adc170428dedf6dba
SHA512 b143a03944670db8bc6744cfbd7952ca3d91fc0de9f4de59e96c1beafb666960c2c15a20c696578aef994b6ea6beb666292408f6917461162ea37a34456f7a05

memory/2668-192-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-193-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-194-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-195-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-196-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-197-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-198-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-200-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-201-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-202-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-203-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-204-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-205-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4240-206-0x0000000000400000-0x0000000002C8F000-memory.dmp