Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 04:33
General
- Target file.exe
- Size 30.1MB
- Sample260802-e6qz5avclc
- SHA256 350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c
Malware Config
Extracted
-
animateclipper
-
bsc.blockrazor.xyz
-
update-S-2-5-26-24247216-2331352693-3112950123
-
0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
-
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
-
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
-
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
-
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
-
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
-
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
-
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
-
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
-
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
-
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
-
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
-
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
-
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
-
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
-
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
-
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
-
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z
-
auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
-
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
-
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6
Content-Type: application/x-www-form-urlencoded
Signatures
- Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Detects AnimateClipper 8 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5108-7-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp
memory/5108-9-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp
memory/5108-8-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp
memory/5108-6-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp
memory/5108-5-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp
memory/5108-4-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp
memory/5108-3-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp
memory/5108-1-0x0000024ECD4B0000-0x0000024ECD4B1000-memory.dmp
memory/5108-21-0x00007FF6DD420000-0x00007FF6DD460000-memory.dmp