Malware Analysis Report

2025-06-16 04:56

Sample ID 230318-am4dwscf2w
Target 4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047
SHA256 4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047
Tags
laplas clipper discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047

Threat Level: Known bad

The file 4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047 was found to be: Known bad.

Malicious Activity Summary

laplas clipper discovery persistence spyware stealer

Laplas Clipper

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Program crash

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Checks processor information in registry

GoLang User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-18 00:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-18 00:20

Reported

2023-03-18 00:23

Platform

win10v2004-20230220-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe"

Signatures

Laplas Clipper

stealer clipper laplas

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe C:\Windows\SysWOW64\cmd.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe C:\Windows\SysWOW64\cmd.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe C:\Windows\SysWOW64\cmd.exe
PID 1528 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe C:\Windows\SysWOW64\cmd.exe
PID 1528 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe C:\Windows\SysWOW64\cmd.exe
PID 1528 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2488 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2488 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2180 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe
PID 2180 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe
PID 2180 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe
PID 3580 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 3580 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 3580 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe

"C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4ec00d007d63e364d0e9b326493fc709b48c5007c848719aebf9094f403b9047.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1528 -ip 1528

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe

"C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 2056

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3580 -ip 3580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 492

Network

Country Destination Domain Proto
LV 45.87.154.30:80 45.87.154.30 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 30.154.87.45.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
N/A 185.119.196.167:80 185.119.196.167 tcp
US 8.8.8.8:53 167.196.119.185.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
LV 45.87.154.105:80 45.87.154.105 tcp
US 8.8.8.8:53 105.154.87.45.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
NL 87.248.202.1:80 tcp
NL 173.223.113.131:80 tcp
NL 173.223.113.164:443 tcp
US 204.79.197.203:80 tcp

Files

memory/1528-134-0x00000000046F0000-0x0000000004705000-memory.dmp

memory/1528-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe

MD5 1874484481b8ba2de4b6da79f1500a7e
SHA1 03b757f78281f3059a47ef9ef5a4d44f00183bc9
SHA256 0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0
SHA512 ef65dbba565d50024df21fcbb78d56890927327fb18e2f55d9d8023d7d79987a15fc261e7c004b921ed434b8bafa97f3ff53fcca7063c944778b694ff19a6b84

C:\Users\Admin\AppData\Local\Temp\AAEBAFBGID.exe

MD5 1874484481b8ba2de4b6da79f1500a7e
SHA1 03b757f78281f3059a47ef9ef5a4d44f00183bc9
SHA256 0b023b998050fc5c048973964889e0d743e184eda905a88204c9feb44490c2f0
SHA512 ef65dbba565d50024df21fcbb78d56890927327fb18e2f55d9d8023d7d79987a15fc261e7c004b921ed434b8bafa97f3ff53fcca7063c944778b694ff19a6b84

memory/3580-205-0x0000000004C20000-0x0000000004FF0000-memory.dmp

memory/1528-206-0x0000000000400000-0x0000000002AFB000-memory.dmp

memory/3580-208-0x0000000000400000-0x0000000002C8F000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 4f593195eeb491901c1140fcb7577a49
SHA1 bfd0351d93e896bb10f5c0c5ba38dc948ace3ab4
SHA256 dd7d6f465996a7c77454bdff48588dd87354aadfad1631fcb731e9fb46ff2358
SHA512 0b646242608e7eb3869690edd642555178223aececda53a06d5e6ff3eb8461bcde9f41b40e847b4a00b107a4f7457e36694653cc49d0dcb5b483be85e3802bbb

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 f3639047f0e23e2591c044c0559b2917
SHA1 2dd21157e554c35cfe179b111d0350b6d5aea15c
SHA256 9b776011f1a5622b7bfa7b2326bbc5f5026c72abcf74fed87d601630aaedc3ea
SHA512 92699f40533ddebd97bbc78b4ef950bafe5c57fb38c9035d5f990800235307bfaade137ff0564223d65480818e6a05a3105698d3806a93e30e5162d4139d288f

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 c402a9c9791550b82abdda5b0c59ed69
SHA1 4e36776ccf1d75bded894c4b7ce2e7fbf3f8c1ef
SHA256 aa9b75bb8177b2dc9d1c59d73ecd717a7e157aa4eb57b674ebe147b911ba0782
SHA512 fa83f39bf6994dce28cd655e01b30b852afa5b92596ac4e83f32ab25ce09950c508b42140f656440535cb73b9f9c633fb39b3fd316b9837fea23f615dc503633

memory/3580-213-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-214-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-215-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-216-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-218-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-219-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-220-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-221-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-222-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-223-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-224-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-225-0x0000000000400000-0x0000000002C8F000-memory.dmp

memory/4424-226-0x0000000000400000-0x0000000002C8F000-memory.dmp