Analysis
- max time kernel
149s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/07/2026, 13:22
General
- Target 1.exe
- Size 15.0MB
- Sample260731-qmapksbb98
- SHA256 fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab
Malware Config
Signatures
- Family: AnimateClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Detects AnimateClipper 8 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/460-1-0x0000016F6B1F0000-0x0000016F6B1F1000-memory.dmp
memory/460-3-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp
memory/460-4-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp
memory/460-8-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp
memory/460-9-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp
memory/460-7-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp
memory/460-6-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp
memory/460-5-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp
memory/460-19-0x00007FF66F7D0000-0x00007FF66F810000-memory.dmp