animateclipper | ddf8b517a8fed544e1adac815a5d85d4c917717449dd52d1354c03f599f05779

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bhatta.exe
Size 3.5MB
Sample260807-1rtncsthnc
SHA256 ddf8b517a8fed544e1adac815a5d85d4c917717449dd52d1354c03f599f05779
MD5 58a519430128d0e52fc10b3bc7fdb717
SHA1 a4933d27e1f7f7331a3a0ab54d6b53339a412777
SHA512 7509cacc3f4388e778dce2387ce501d65459987ced51421fd6fab8b26ceab7a5fc51c59fffc46505e03915d25ec5590be4e4e3c5f2fa58c41234a34119904077
SSDEEP 98304:qbOjLYrCy3QaujOhsqgm9ivYauj9wRp78l5wR1M0Hi1lrD0/BmKVsMVhmYR/A:qFGmYRI
TLSH
T16A068C03AC9249F5C0A9B731C8B7425277A5BC489B3237D72EA1BAB82F327C15E35754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper discovery animateclipper spyware stealer

Malware Config

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8eb9a56afbe6d79aa90fba9c8f6af7321490c786
1B7GRvB1WMZYNCz5FdXocHicUyp8pj1FvX
1Ht6TLmpMc3xhN5euPZo5ecC4RJtfJrJu8
3BJquhr9pnQhMo1RCPJHsKnrUKgs8StkKT
8SjFSqSJ6DYAcBJrNGN76hEhcij5vtyJK5G819CvV7Fm
DKSfYvjh8hZwR6q3nNvtKYrgK892groxfd
LNMjkFCv1R2T5vwvuXmUFHHeJLmYAdgzX3
TSw3kk2GCyUUsGnvR2ZHSNoEaWkhfkGE1J
UQCYdXT16Xxzr1qCSVxxntce0-UYXmcqJ_aodkoq39Fv2E6f
XdJHMeC11gmiA5rpnJhu9cTax61q333o1g
bc1qw8wnedcwur3e4pq6qpdrquxpd09a5lss5glf77
cosmos1pgtakf0xe8ehexdgqz9c3lj436wyyg772qec8m
ltc1qs9whv7632zyrr828n7e6g5jqtq0ykgklvfm80u
qphwpg3ja0awpjt2vrfy5mxmk3h24vrswg9ll9umkm
rKaNCgLvMEXxNzMxj2F7FYi1AdRrTo6Nhu

Attributes

auth_token
824c6b4d-4f01-4e22-a500-c7d239e10480
contract
0x77c08D8A4Eab268fd5728ae8fE41b1FDE52967dF
headers
Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480

Content-Type: application/x-www-form-urlencoded

Signatures

Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper

Detects AnimateClipper 4 IoCs

resource	yara_rule
behavioral2/memory/3884-42-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/3884-41-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/3884-40-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/3884-39-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	3524	bhatta.exe

Executes dropped EXE 2 IoCs

pid	Process
1404	eLgTgUSdCMJU.exe
3884	c8EulOb09Lt6.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bhatta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bhatta.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3524	bhatta.exe
3524	bhatta.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4248	3524	bhatta.exe	89
PID 3524 wrote to memory of 4248	3524	bhatta.exe	89
PID 3524 wrote to memory of 6012	3524	bhatta.exe	92
PID 3524 wrote to memory of 6012	3524	bhatta.exe	92
PID 3524 wrote to memory of 5852	3524	bhatta.exe	96
PID 3524 wrote to memory of 5852	3524	bhatta.exe	96
PID 3524 wrote to memory of 2752	3524	bhatta.exe	99
PID 3524 wrote to memory of 2752	3524	bhatta.exe	99
PID 3524 wrote to memory of 1404	3524	bhatta.exe	102
PID 3524 wrote to memory of 3884	3524	bhatta.exe	103

C:\Users\Admin\AppData\Local\Temp\bhatta.exe
"C:\Users\Admin\AppData\Local\Temp\bhatta.exe"
1⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2752
- C:\Users\Admin\AppData\Local\eLgTgUSdCMJU.exe
  "C:\Users\Admin\AppData\Local\eLgTgUSdCMJU.exe"
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Users\Admin\AppData\Local\c8EulOb09Lt6.exe
  "C:\Users\Admin\AppData\Local\c8EulOb09Lt6.exe"
  2⤵
  - Executes dropped EXE
  PID:3884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07FE1A2C-AE93-A400-AF34-EBC847BCC310.txt

Path C:\ProgramData\07FE1A2C-AE93-A400-AF34-EBC847BCC310.txt
Size 64B
SHA256 e06adfc528002b5d32aa1191bb28ad1033fa6d22da7850dfaa598b0ee17a59b9
MD5 7212d507ce8b56dbca20461adecbbcee
SHA1 db5720b662d03435730251df781de5c5d7a8729d
SHA512 a17b208d8310afb82c7070f5e2b64f9fc92bb0e84b290a69a65a3e0dbf9a26e9f529878f3606f94df62b7bb24d107c2664976b798bd4ef98f233025434d918ac
TLSH
T15BA0220C00202E8800CEEE22BBC22222C3800030082A3CAC0CBEB88CA200008002BA88
MD5 SHA1 SHA512 TLSH

Submit Download

c8EulOb09Lt6.exe

Path C:\Users\Admin\AppData\Local\c8EulOb09Lt6.exe
Size 3.8MB
SHA256 5c047137f0216fadb95aaf302809eb0ac2f3db0c36729152c1351fb821d94fca
MD5 c3b3b58a8af1db66d1545d96c0eb78ce
SHA1 494832005793fe3cf94814a79cdbda455dbfc197
SHA512 f553298e6c1d3f59d241faa3b7f068275fbc2860ce436627e0b551e0e4d1fa55a4e5c6d1dd9f0df626ed0b8ee082ea0087ffabec781b78469a0a9595a5db0ad4
SSDEEP 49152:aWbirj7IXa/baXHl1tYDPsAKQwvyt+zRksVwX4VcLwU:aLEXHv9mtmRkpXL
TLSH
T1AC064983BCA548FAC0D6A33188A65256BB31BC0C5B3533D32EA0BBB42E767D15E75714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eLgTgUSdCMJU.exe

Path C:\Users\Admin\AppData\Local\eLgTgUSdCMJU.exe
Size 3.6MB
SHA256 239ef2d2bf331088146b00d3ae136d0291587f6b36fcc5e316bc1f0bb0aa5b3d
MD5 62d706fb15cf867ed60a4a3c2ed70b1a
SHA1 b33b94377bf1fa3410f259aa8555fe8a72412595
SHA512 fe464756cd01c5746573ea85975f0086a6d7f5de0d8bc09f1ce1b15308e544030bd822d7f50048a6c9a92593d720efc454bc3ede0aa672f14de9deb9c2b0fc77
SSDEEP 98304:fYIJCAcsYr5CxkYzPMifuL21zRb6lUwBbMuqt3th:AI4JjrIxrrASHubMuqN
TLSH
T14806229573B2C53DE9628B789C30C65416323C1E6AA9C49C9D4A1C4C9876BD7CA03EFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-37-0x0000020B16C70000-0x0000020B1700E000-memory.dmp

Download

memory/3524-6-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-9-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-1-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-3-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-2-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-10-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-5-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-4-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-0-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-11-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-14-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-7-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-17-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-8-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-12-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-36-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-13-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3524-38-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/3884-42-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/3884-41-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/3884-40-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/3884-39-0x0000000140000000-0x0000000140040000-memory.dmp

Download