Malware Analysis Report

2025-06-16 04:56

Sample ID 230317-zr1k8sca5t
Target tmp
SHA256 507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082
Tags
laplas clipper discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

507da6dd60f7fdeecbd1286dac0458ce493ecb89eae4b398695e98f0aaaf7082

Threat Level: Known bad

The file tmp was found to be: Known bad.

Malicious Activity Summary

laplas clipper discovery persistence spyware stealer

Laplas Clipper

Downloads MZ/PE file

Deletes itself

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Adds Run key to start application

Enumerates physical storage devices

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

GoLang User-Agent

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-17 20:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 20:57

Reported

2023-03-17 21:00

Platform

win7-20230220-en

Max time kernel

134s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Downloads MZ/PE file

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1296 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1740 wrote to memory of 112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1740 wrote to memory of 112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1740 wrote to memory of 112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe
PID 1632 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe
PID 1632 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe
PID 1632 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe
PID 1784 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 1784 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 1784 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 1784 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\tmp.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe

"C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe"

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Network

Country Destination Domain Proto
LV 45.87.154.30:80 45.87.154.30 tcp
N/A 185.119.196.167:80 185.119.196.167 tcp
LV 45.87.154.105:80 45.87.154.105 tcp

Files

memory/1296-55-0x0000000000230000-0x0000000000245000-memory.dmp

memory/1296-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/1296-114-0x0000000000400000-0x0000000002AFB000-memory.dmp

memory/1296-118-0x0000000000400000-0x0000000002AFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe

MD5 4c89113e9ec9f66382893b6e3b206667
SHA1 d4391bcc02d5589c6c4efc3936048825a2ccbd21
SHA256 feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1
SHA512 349efe882aba9a626a461c02c4e431e16114a59eb916d805f7a1d3fbc2194b6c41b29757c1aa1765eac9f2b276b02ed9e66535476a9b4be7106832ce964f2b5e

\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe

MD5 4c89113e9ec9f66382893b6e3b206667
SHA1 d4391bcc02d5589c6c4efc3936048825a2ccbd21
SHA256 feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1
SHA512 349efe882aba9a626a461c02c4e431e16114a59eb916d805f7a1d3fbc2194b6c41b29757c1aa1765eac9f2b276b02ed9e66535476a9b4be7106832ce964f2b5e

\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe

MD5 4c89113e9ec9f66382893b6e3b206667
SHA1 d4391bcc02d5589c6c4efc3936048825a2ccbd21
SHA256 feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1
SHA512 349efe882aba9a626a461c02c4e431e16114a59eb916d805f7a1d3fbc2194b6c41b29757c1aa1765eac9f2b276b02ed9e66535476a9b4be7106832ce964f2b5e

C:\Users\Admin\AppData\Local\Temp\IJKKKFCFHC.exe

MD5 4c89113e9ec9f66382893b6e3b206667
SHA1 d4391bcc02d5589c6c4efc3936048825a2ccbd21
SHA256 feb5a0556e226e438f4ca419f476e611df2ff7112a0668303b2da9ef1d2b89b1
SHA512 349efe882aba9a626a461c02c4e431e16114a59eb916d805f7a1d3fbc2194b6c41b29757c1aa1765eac9f2b276b02ed9e66535476a9b4be7106832ce964f2b5e

memory/1784-123-0x0000000004670000-0x000000000481A000-memory.dmp

memory/1784-124-0x0000000004820000-0x0000000004BF0000-memory.dmp

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 0e9b8595b1d564b208bf21a63bcf6c6f
SHA1 0bfce482513d62da31d1ee9701563ba2fe7d415a
SHA256 83afdf2399d02f6bf913c0d9cf2a29a8af3168300d617c422f00383ec3d86e01
SHA512 ca8a0e66af599ca5bd8c0ddaed9c7737d455ca60c2ccb37e06a99089045e7c8988aec507aa3693f988cc04475ab6c335c778dc2c1fa0fcea95d2e4a317ab4632

memory/1616-133-0x00000000047A0000-0x000000000494A000-memory.dmp

\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 472c3414464df2c86dde153fe9e14bdb
SHA1 a72421fbe5539421a408a6a8d8a3d009a0706aa7
SHA256 a462506fbb90da596ab072b485b4239f7d68e6a75a8c345b36e38547d65f1fa9
SHA512 16dc5d568efeb052f5ba7032fff3d7f9d4c6b58618e26d5adf229c0e46f274bbd8cd33be92b900a243a4b03851c65500976f64e8e7b2ba13c825a42e0b3b8d7b

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 8f993a7b49006275be45c59108055154
SHA1 f757e89b190e18269b9a1d7c3eab5fdbbdf1edf7
SHA256 a86ba7795a2c6b61c3a577ebf6dacd1c290c7c3dc520a2868a68c390ff8dae88
SHA512 206882c51bacc87b115b7aeb9a8bbf542c05c3ee44ac2039b01d8c964f1519d49f2198b1e51c89eda0f5b555db0d5531ffbf296f7571c665c7140e88e7c0f4dc

memory/1784-134-0x0000000000400000-0x0000000002C8F000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 b15f2d5f1c7ae8e12360ca90dc7c86f6
SHA1 8d43d6e04a058daa7039b632b80393182f125dcf
SHA256 208827b8ead482074ce7a87206d09a7f22f4db3a1ffe423c2878c42865d5cc1f
SHA512 603bd01845dc3fad42d7b85debeeb8b33598e38ae6e34a38c5e41f96800983a06f4d92b6587ea9a9d0279d764c5df291e7ae6f2f3320843ea703812594f33826

memory/1616-135-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-136-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-137-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-140-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-141-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-142-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-143-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-144-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-145-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/1616-146-0x0000000000400000-0x0000000002C8F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-17 20:57

Reported

2023-03-17 21:07

Platform

win10v2004-20230220-en

Max time kernel

56s

Max time network

78s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp

Files

N/A