Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 00:00
General
- Target 2026-07-23_9684b0229634d90636f8c1cf68589484_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader.exe
- Size 22.6MB
- Sample260724-aake9azakc
- SHA256 86471a7fea86de0cd8301ab2e5220170e154f71a14ce04b15ba67d1ab62a0b7c
Malware Config
Signatures
- Family: AnimateClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Detects AnimateClipper 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_9684b0229634d90636f8c1cf68589484_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_9684b0229634d90636f8c1cf68589484_amadey_blankgrabber_elex_glassworm_luca-stealer_magniber_njrat_smoke-loader.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3cgab00IGWbIyFIS\jhsdb.exe"C:\Users\Admin\AppData\Local\Temp\3cgab00IGWbIyFIS\jhsdb.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
-
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9bc9ac728,0x7ff9bc9ac734,0x7ff9bc9ac7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,15651321329082899015,13014109675349474893,262144 --field-trial-handle=1920,i,6336246056023834098,3413357538237914624,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,6457562592329624157,17749435171391511816,524288 --field-trial-handle=1920,i,6336246056023834098,3413357538237914624,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,15132988682650971277,357486206286068054,524288 --field-trial-handle=1920,i,6336246056023834098,3413357538237914624,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,11106178500418856624,15487017256315656075,2097152 --field-trial-handle=1920,i,6336246056023834098,3413357538237914624,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,8823600105901838636,4368542800045830127,2097152 --field-trial-handle=1920,i,6336246056023834098,3413357538237914624,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,14390511100122780812,5469433108071914610,2097152 --field-trial-handle=1920,i,6336246056023834098,3413357538237914624,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:13⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\prxhbc8nb" "C:\ProgramData\prxhbc8nb\jhsdb.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\prxhbc8nb\jhsdb.exe"C:\ProgramData\prxhbc8nb\jhsdb.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
Local State
VCRUNTIME140.dll
jhsdb.exe
jli.dll
msvcp140.dll
ucrtbase.dll
vcruntime140_1.dll
memory/1776-1851-0x0000000140000000-0x0000000140040000-memory.dmp
memory/5112-1863-0x0000000001520000-0x0000000001523000-memory.dmp
memory/5112-1864-0x0000000003870000-0x0000000003E42000-memory.dmp
memory/5112-1868-0x0000000003870000-0x0000000003E42000-memory.dmp
memory/5112-1870-0x0000000003870000-0x0000000003E42000-memory.dmp
memory/5112-1869-0x0000000003870000-0x0000000003E42000-memory.dmp
memory/5856-1377-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1142-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1331-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-0-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1369-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1362-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1355-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1344-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1337-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1322-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1315-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1308-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1301-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1298-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1279-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1272-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1265-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1243-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1229-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1215-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1250-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1236-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1208-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1186-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1172-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1193-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1179-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1157-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1145-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1286-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1139-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1137-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1382-0x00000000FFE30000-0x00000000FFE78000-memory.dmp
memory/5856-1395-0x00000000FFE90000-0x00000000FFE91000-memory.dmp
memory/5856-1396-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-1535-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-1536-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-1257-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1222-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1200-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1613-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-1635-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-1804-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-1166-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-1150-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1136-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1148-0x0000000001F60000-0x0000000001FD0000-memory.dmp
memory/5856-552-0x0000000077A18000-0x0000000077A19000-memory.dmp
memory/5856-22-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-3-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-5-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-6-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-14-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-10-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-9-0x00000000FFCD0000-0x00000000FFCD1000-memory.dmp
memory/5856-1871-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-2240-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-2241-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-2243-0x0000000004D90000-0x0000000004E42000-memory.dmp
memory/5856-2242-0x0000000004D90000-0x0000000004E42000-memory.dmp