ec069915e5fa8d167ee6967140d5fbbcb59f0d0befa5f6d0cae899fd71ee5da9

Resubmissions

23/02/2024, 05:58

240223-gn5rnsch557

23/02/2024, 05:52

240223-gk6vkacc5z7

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
minecraft.exe
Size 22.1MB
Sample240223-gn5rnsch55
SHA256 ec069915e5fa8d167ee6967140d5fbbcb59f0d0befa5f6d0cae899fd71ee5da9
MD5 86dc20f843bfa46275568d0a4d5e1d2d
SHA1 01d0e36b281f4fff62378d97398cd7b688201197
SHA512 28e9a7860ef4c146d34952a38c6380bc36452f3c8bdf54d6aecd98fd3ad3c758765de46eebd411abd647022afcc65b6119ebeb84f3af6425deefa58800181404
SSDEEP 393216:pOqGolKT5VhfpjWUjw1O484xLUJO78Tlxf12Fovy4:wqGvVhfpjWE43GO7a1H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000002323d-45.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
3672	javaw.exe
3672	javaw.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
64	icacls.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002323d-45.dat	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3672	javaw.exe
3672	javaw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3308	1384	minecraft.exe	87
PID 1384 wrote to memory of 3308	1384	minecraft.exe	87
PID 3308 wrote to memory of 3672	3308	cmd.exe	89
PID 3308 wrote to memory of 3672	3308	cmd.exe	89
PID 3672 wrote to memory of 64	3672	javaw.exe	90
PID 3672 wrote to memory of 64	3672	javaw.exe	90

C:\Users\Admin\AppData\Local\Temp\minecraft.exe
"C:\Users\Admin\AppData\Local\Temp\minecraft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c javaw -Dhttp.proxyHost=betacraft.pl -jar natives/error437.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
    javaw -Dhttp.proxyHost=betacraft.pl -jar natives/error437.dll
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      4⤵
      Modifies file permissions
      PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 585c9e36259452e126cb596324213e2d14cc6516fcc32832065da2585dd3a1cd
MD5 be488684057d6df5d8b43df5dfc0d3a7
SHA1 eac08ea88c404953144c635d6073a6efca604d1a
SHA512 7a1ac28416dc5b5f532102c426c88b0530051287e9a4dad0f01899ee47b3d20e353adee60381e262bf09d2be4ecd5be631eabf3904263010b06709e3714d99ba
MD5 SHA1 SHA512

Submit Download

consoleLib-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\natives\consoleLib-x64.dll
Size 14KB
SHA256 d7cd5122b1ae19a8b95ec9e5db5c3055e3936a546bc22c4f1c7911c3629ab021
MD5 9fd4366231018993914ec6546e3e6083
SHA1 ca8a03e81aefeccbbaf766b91b116da4bb53c34d
SHA512 9b2b013747593f540874adb9c6e9cc64a2985e0975af2ef86dbb63682d967fce028cab43aa2211e76a1fc5ecc037b6dcc4a80503ca55421fd85166dcbda95364
SSDEEP 192:LSKcy5BAfaSuwya98PX8ghuRXjsQ6O62qT7JBrgKBVwWQWqtIO8+/74e:x1BSuta08gINjsI+T9B0cpO8Pe
MD5 SHA1 SHA512 SSDEEP

Submit Download

err0r437.dll

Path C:\Users\Admin\AppData\Local\Temp\natives\err0r437.dll
Size 648KB
SHA256 4560cf70d22705561e40bce528b6a74bff83630ea91a5b14e0560a114b31dfe0
MD5 1930033c78ef88a4fb03de9db6042f0d
SHA1 ea2437dc06aae3ae434baf271d5d0d0df9835e58
SHA512 ab881e4eac21268d3693536b6bb3b3b4b6f8bdc8662240b91befe192f72e34dc64998cc4ed9fa1873f2ba637c62af7102adf066ea6ec29ce8fbe86b663224fee
SSDEEP 12288:8q4kocpT1xQGSMnRQsiXOICRHCvCA6DFyJglRx+DABPYfkrtKjGHIFGyQLU5ex7Z:Ckoq5xQhMnisiXOICgp0cJglR1lYfk5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

error437.dll

Path C:\Users\Admin\AppData\Local\Temp\natives\error437.dll
Size 8.3MB
SHA256 1f51f202b7e749efea97c44a6eb24db4e5fe75a3a2d7f7a4612fd811f2761e6b
MD5 3a4bbf442bc72498b07e5406b3d2fb31
SHA1 42c58e32fbc47d25b7f52f866fcc674fe17c0b42
SHA512 87e320975930be4142d0f213a4c0e398287cc7f27aeba8132e3f12afa7439527e56ec6a08b3c16408dcd69c72ed8880bba5d5cc6bfe6b21049a86552d53c50b8
SSDEEP 196608:iubxBmCkT5Sbdshfpjzj+Ujfo1PG6Nfl84u4BBZL:BlKT5VhfpjWUjw1O484xLd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lwjgl64.dll

Path C:\Users\Admin\AppData\Local\Temp\natives\lwjgl64.dll
Size 303KB
SHA256 19ddc120c3f382cebc249da69f7cec7d71f7a665054f8d6f5c6f5bde6cfd2297
MD5 3fcf8b1bd4c9066ff815d887a4192456
SHA1 d8bc4e20accb989fe9d774ede6c198781c2067c7
SHA512 56ead9bdcd9e83e2651ba22ea2224e83ae205644bf6823776af5b7afee40aba4b355b9cfc0cbf22521236b441899b77904b5ce49b120b3ad717f04d5b8da6d87
SSDEEP 3072:IH7SYRXGnE0P/m2SoY4i6sxfQ7Gw2IZfsSsKQAgCu7Vce6HPKVFlCs7NZqSEgo:kWE0nm1o1Cw22gCupcBvKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1384-38-0x0000000000400000-0x0000000001A28000-memory.dmp

Download

memory/3672-49-0x0000020698640000-0x0000020698641000-memory.dmp

Download

memory/3672-39-0x0000020698640000-0x0000020698641000-memory.dmp

Download

memory/3672-51-0x0000020698640000-0x0000020698641000-memory.dmp

Download

memory/3672-54-0x0000000062240000-0x000000006224D000-memory.dmp

Download

memory/3672-63-0x0000020698640000-0x0000020698641000-memory.dmp

Download

memory/3672-64-0x0000020698640000-0x0000020698641000-memory.dmp

Download

memory/3672-73-0x0000020698640000-0x0000020698641000-memory.dmp

Download

memory/3672-93-0x0000020698640000-0x0000020698641000-memory.dmp

Download

memory/3672-96-0x0000020699FB0000-0x000002069AFB0000-memory.dmp

Download

memory/3672-29-0x0000020699FB0000-0x000002069AFB0000-memory.dmp

Download

memory/3672-143-0x0000020699FB0000-0x000002069AFB0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads