keyzetsu | ff8f55d4715752aec71f60d00612e36b172708d3fa61c5e131f96966f0dd5017

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/03/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
601c25496c92e86210fc4351e46b9f5c.exe
Size 498KB
Sample260313-vh45vad14v
SHA256 ff8f55d4715752aec71f60d00612e36b172708d3fa61c5e131f96966f0dd5017
MD5 601c25496c92e86210fc4351e46b9f5c
SHA1 8ab9bf21aa3e8257a1fcf0341f5f9362f8ca0466
SHA512 09c1c466bb89e3873fd7e51e7cb1b36c18a916143f1ebd93a22070d9115eb6d6fa137987205adb09928260f097d57dfba405e70d9422bc0bbb925905f827102e
SSDEEP 12288:l2QRXDD1yed0fsU4GSWgOvPESGj4s32xEdRCSOn:l2Q9NXw2/wPOjdGxYG
TLSH
T1BEB4129476F7244CFBBF5EBA87E1F65C4274E523AA04A08539C11345CB269C19E23B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution keyzetsu persistence stealer

Malware Config

Signatures

Detects KeyzetsuClipper payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b443-7.dat	family_keyzetsu_clipper

Keyzetsu family
keyzetsu
KeyzetsuClipper
KeyzetsuClipper is a Windows stealer written C#.
stealer keyzetsu

Executes dropped EXE 2 IoCs

pid	Process
876	svchost.exe
1552	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System_Tools = "C:\\ProgramData\\Appxetry\\svchost.exe"	601c25496c92e86210fc4351e46b9f5c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1736	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3804	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
876	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	601c25496c92e86210fc4351e46b9f5c.exe
Token: SeDebugPrivilege	876	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3804	1292	601c25496c92e86210fc4351e46b9f5c.exe	79
PID 1292 wrote to memory of 876	1292	601c25496c92e86210fc4351e46b9f5c.exe	81
PID 1292 wrote to memory of 5096	1292	601c25496c92e86210fc4351e46b9f5c.exe	82
PID 5096 wrote to memory of 1736	5096	cmd.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\601c25496c92e86210fc4351e46b9f5c.exe
"C:\Users\Admin\AppData\Local\Temp\601c25496c92e86210fc4351e46b9f5c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn System_Tools /tr "C:\ProgramData\Appxetry\svchost.exe" /st 17:05 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3804
- C:\ProgramData\Appxetry\svchost.exe
  "C:\ProgramData\Appxetry\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp74E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\timeout.exe
    timeout 7
    3⤵
    - Delays execution with timeout.exe
    PID:1736

C:\ProgramData\Appxetry\svchost.exe
C:\ProgramData\Appxetry\svchost.exe
1⤵
- Executes dropped EXE
PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\ProgramData\Appxetry\svchost.exe
Size 498KB
SHA256 ff8f55d4715752aec71f60d00612e36b172708d3fa61c5e131f96966f0dd5017
MD5 601c25496c92e86210fc4351e46b9f5c
SHA1 8ab9bf21aa3e8257a1fcf0341f5f9362f8ca0466
SHA512 09c1c466bb89e3873fd7e51e7cb1b36c18a916143f1ebd93a22070d9115eb6d6fa137987205adb09928260f097d57dfba405e70d9422bc0bbb925905f827102e
SSDEEP 12288:l2QRXDD1yed0fsU4GSWgOvPESGj4s32xEdRCSOn:l2Q9NXw2/wPOjdGxYG
TLSH
T1BEB4129476F7244CFBBF5EBA87E1F65C4274E523AA04A08539C11345CB269C19E23B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp74E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp74E.tmp.bat
Size 183B
SHA256 13a45a3db30bdddcd475479c32c83b85aaf8fe2da64d976b692b2c0f3376cb99
MD5 73075b4ed5d23ee0cffd598e0ac410c7
SHA1 620a38a4f678fd60ab35b5d40e6c9a876d1cff36
SHA512 dc01b76f7c39be7bb2abf83768a4a11084aa23f1cfe1a19abdb86029038cc97074685a081c4a492855a90eef061287a6e4770224ee2a7f088619c16f11e2737c
TLSH
T184C0804066CEFB5B2D4B55371176C58DC0675C4A3EC46B14575C400455C585DE9F5345
MD5 SHA1 SHA512 TLSH

Submit Download

SyncComplete.php

Path C:\Users\Admin\Desktop\SyncComplete.php
Size 704KB
SHA256 3f31af2f06c34c34f46552a191d0347a54f41edc3b9ee165e2ef664a58c035a8
MD5 ca3ebb34a69f48f214f9d89b1ea1af74
SHA1 f79f779e9cb1f696df0b9bab812d076b5481cd8c
SHA512 e10919f613ca7b7d54bfc6aac4fa110d9f3f248e0dc6b9f0f1d0159dff244696616d94855772b15017e50b718ee458957807ccce373f7ebd94ec06e358af3d23
SSDEEP 12288:nWeaz/DpXsUv+5mz4oBNJM4flWPWjffljz2Y:nWhz/DpXv+8zTBNG4flWPWjffljKY
TLSH
T1D2E47DBBD8E6236E5E90D39F549CBE72A2E37708E2939D1C149433894BA5ACD0F111F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/876-49-0x000000001D570000-0x000000001D582000-memory.dmp

Download

memory/876-48-0x000000001B9A0000-0x000000001B9AC000-memory.dmp

Download

memory/1292-0-0x0000000000C70000-0x0000000000CF2000-memory.dmp

Download

memory/1292-1-0x000000001B990000-0x000000001B9A0000-memory.dmp

Download

memory/1292-17-0x0000000002EF0000-0x0000000002EFC000-memory.dmp

Download

memory/1292-18-0x0000000002F30000-0x0000000002F42000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads