Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 00:17
General
- Target 1.exe
- Size 15.0MB
- Sample260807-ak87csxtdv
- SHA256 fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab
Malware Config
Extracted
-
animateclipper
-
bsc.blockrazor.xyz
-
update-S-2-5-26-24247216-2331352693-3112950123
-
0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
-
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
-
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
-
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
-
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
-
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
-
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
-
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
-
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
-
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
-
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
-
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
-
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
-
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
-
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
-
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
-
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
-
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z
-
auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
-
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
-
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6
Content-Type: application/x-www-form-urlencoded
Signatures
- Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Detects AnimateClipper 7 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1988-1-0x000001E1D1C60000-0x000001E1D1C61000-memory.dmp
memory/1988-4-0x00007FF7C3000000-0x00007FF7C3040000-memory.dmp
memory/1988-3-0x00007FF7C3000000-0x00007FF7C3040000-memory.dmp
memory/1988-9-0x00007FF7C3000000-0x00007FF7C3040000-memory.dmp
memory/1988-8-0x00007FF7C3000000-0x00007FF7C3040000-memory.dmp
memory/1988-7-0x00007FF7C3000000-0x00007FF7C3040000-memory.dmp
memory/1988-6-0x00007FF7C3000000-0x00007FF7C3040000-memory.dmp
memory/1988-5-0x00007FF7C3000000-0x00007FF7C3040000-memory.dmp