lclipper | ee569d3bef54ffac9649d869a5642b885b1243b47fa8067835582b63daf1eb42

Analysis

max time kernel
141s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
08/09/2025, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
393417ce4ce5c01da34b249f67948c60.exe
Size 4.5MB
Sample250908-emdkpasshv
SHA256 ee569d3bef54ffac9649d869a5642b885b1243b47fa8067835582b63daf1eb42
MD5 393417ce4ce5c01da34b249f67948c60
SHA1 21a8e541f5a183a5239b4a57662fcccc0e194942
SHA512 9d8686db579a11d065b9dec5d3538607cdbd7af8dd6e9854218179cf92c62350cb52a8b8236369c42b38f4b596105522bcfdb6d07dc7f71a4e38d215e60de008
SSDEEP 98304:dhTstDQ4dhTAd18Jjdq9M4aSmP8HFIhxw1GGJIhnNPg:D+ndZAr8/q+4aFIFKvrP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery lclipper persistence stealer

Malware Config

Extracted

Family

lclipper

https://api.telegram.org/bot7841921350:AAFGkor-dSPkf-PgNgU6DqA2BBmIM8f_vRU/sendMessage?chat_id=6299414420&text=

Signatures

LClipper
LClipper is a stealer written in C++.
stealer lclipper
Lclipper family
lclipper

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoogleChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GoogleChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	393417ce4ce5c01da34b249f67948c60.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	393417ce4ce5c01da34b249f67948c60.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoogleChrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GoogleChrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3272	GoogleChrome.exe
4420	GoogleChrome.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chromium = "C:\\Users\\Admin\\AppData\\Local\\GoogleChrome.exe"	393417ce4ce5c01da34b249f67948c60.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3876	cmd.exe
4372	PING.EXE
712	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4372	PING.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 712	1684	393417ce4ce5c01da34b249f67948c60.exe	78
PID 1684 wrote to memory of 712	1684	393417ce4ce5c01da34b249f67948c60.exe	78
PID 712 wrote to memory of 3876	712	cmd.exe	82
PID 712 wrote to memory of 3876	712	cmd.exe	82
PID 4084 wrote to memory of 3272	4084	cmd.exe	83
PID 4084 wrote to memory of 3272	4084	cmd.exe	83
PID 3876 wrote to memory of 4372	3876	cmd.exe	85
PID 3876 wrote to memory of 4372	3876	cmd.exe	85
PID 3876 wrote to memory of 4420	3876	cmd.exe	86
PID 3876 wrote to memory of 4420	3876	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\393417ce4ce5c01da34b249f67948c60.exe
"C:\Users\Admin\AppData\Local\Temp\393417ce4ce5c01da34b249f67948c60.exe"
1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\GoogleChrome.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\system32\cmd.exe
    cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\GoogleChrome.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4372
  - - C:\Users\Admin\AppData\Local\GoogleChrome.exe
      C:\Users\Admin\AppData\Local\GoogleChrome.exe
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      PID:4420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\GoogleChrome.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\GoogleChrome.exe
  C:\Users\Admin\AppData\Local\GoogleChrome.exe
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleChrome.exe

Path C:\Users\Admin\AppData\Local\GoogleChrome.exe
Size 4.5MB
SHA256 ee569d3bef54ffac9649d869a5642b885b1243b47fa8067835582b63daf1eb42
MD5 393417ce4ce5c01da34b249f67948c60
SHA1 21a8e541f5a183a5239b4a57662fcccc0e194942
SHA512 9d8686db579a11d065b9dec5d3538607cdbd7af8dd6e9854218179cf92c62350cb52a8b8236369c42b38f4b596105522bcfdb6d07dc7f71a4e38d215e60de008
SSDEEP 98304:dhTstDQ4dhTAd18Jjdq9M4aSmP8HFIhxw1GGJIhnNPg:D+ndZAr8/q+4aFIFKvrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1684-0-0x00007FF6C9570000-0x00007FF6C9EDE000-memory.dmp

Download

memory/1684-4-0x00007FF6C9570000-0x00007FF6C9EDE000-memory.dmp

Download

memory/3272-34-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-31-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-39-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-25-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-26-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-27-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-28-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-29-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-30-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-38-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-32-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-33-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-8-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-35-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-36-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/3272-37-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/4420-11-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

memory/4420-24-0x00007FF638120000-0x00007FF638A8E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads