> Technique · dotnet-clipboard-ole-hijack — OLE IDataObject COM interop for clipboard manipulation in .NET_

~/packetpursuit $ cat /intel/techniques/dotnet-clipboard-ole-hijack.md

typetechniqueconfidencehighcreated2026-06-27updated2026-06-27collectiondotnetcomclipboardmalware-familycollection

dotnet-clipboard-ole-hijack

Definition

A .NET-specific collection technique in which malware uses the Windows OLE IDataObject COM interface (via System.Runtime.InteropServices.ComTypes.IDataObject) to read, write, and enumerate clipboard formats. Unlike simpler P/Invoke OpenClipboard/SetClipboardData approaches, this method leverages the full OLE data-transfer surface, enabling rich-format clipboard manipulation (text, HTML, images, file drops) and better evasion of naive API-hooking EDR products.

Mechanism

  1. Obtain an IDataObject instance from the clipboard or construct one in-memory.
  2. Query available formats via EnumFormatEtc / QueryGetData.
  3. Read data via GetData(FORMATETC, out STGMEDIUM).
  4. Replace or inject data via SetData, then flush to the system clipboard.
  5. Optionally enumerate CF_TEXT, CF_UNICODETEXT, CF_BITMAP, CF_HDROP, CF_HTML, and custom registered formats.

Observed Implementations

a9b5e7469c35 (Kopija_bankovnog_placanja.exe)

  • Full IDataObject interface surface present in strings: GetData, QueryGetData, SetData, GetCanonicalFormatEtc, EnumFormatEtc, DAdvise, DUnadvise ^[strings.txt:48-55,112,117-120]
  • Supporting helpers: GetText, SetText, GetImage, SetImage, GetAudioStream, ContainsImage, ContainsAudio ^[strings.txt:74-76,177-178,204-205]
  • Memory-protection constants (PAGE_EXECUTE_READWRITE, PAGE_READWRITE) suggest decrypted payload staging ^[strings.txt:26-28]
  • No wallet regex strings recovered statically; clipboard logic may be AES-encrypted or runtime-resolved.

Why OLE vs Raw P/Invoke

Aspect P/Invoke (user32.dll) OLE IDataObject
EDR hook coverage High (most EDRs hook OpenClipboard) Lower (COM interop is less commonly instrumented)
Format support Basic (CF_TEXT, CF_BITMAP) Rich (CF_HTML, CF_HDROP, custom)
.NET integration Requires DllImport declarations Native System.Runtime.InteropServices.ComTypes
Async / advise None DAdvise / DUnadvise for change notifications

Detection

  • Clipboard format enumeration: look for EnumFormatEtc calls from managed processes.
  • COM apartment-threaded STA initialization in console binaries (unusual).
  • Suspicious IDataObject usage in non-Office/non-browser processes.

Related