Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 03:59
General
- Target mc.exe
- Size 6.0MB
- Sample260506-ekby3set2k
- SHA256 1bf73f2db8e60fd505a03c8819170ed0cfdf48aec4be9b940fee20ea40fc8f45
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mc.exe"C:\Users\Admin\AppData\Local\Temp\mc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\25A4.tmp\25A5.tmp\25A6.bat C:\Users\Admin\AppData\Local\Temp\mc.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar ERROR666.jar com.jdsoft.jarload.CLASSLOAD3⤵
-
-
C:\Users\Admin\AppData\Roaming\ERROR666.jarERROR666.jar3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mc.scrC:\Windows\system32\\mc.scr4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\%random%\Client.exe"C:\Users\Admin\AppData\Roaming\%random%\Client.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4B5C.tmp\4B5D.tmp\4B5E.bat C:\Users\Admin\AppData\Roaming\%random%\Client.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -Xmx1024M -Xms1024M -cp database.db "-Dorg.lwjgl.librarypath=C:\Users\Admin\AppData\Roaming\%random%/natives" "-Dnet.java.games.input.librarypath=C:\Users\Admin\AppData\Roaming\%random%/natives" Start7⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
25A6.bat
4B5E.bat
Client.exe
database.db
lwjgl.dll
lwjgl64.dll
ERROR666.jar
mc.scr
memory/3004-89-0x0000000000400000-0x0000000000E3F000-memory.dmp
memory/3004-90-0x00000000012B0000-0x000000000132C000-memory.dmp
memory/4600-93-0x000001FDCF440000-0x000001FDCF44C000-memory.dmp
memory/4600-79-0x000001FDB6BE0000-0x000001FDB6BE1000-memory.dmp
memory/4600-87-0x000001FDB6BE0000-0x000001FDB6BE1000-memory.dmp
memory/4600-64-0x000001FDB6BE0000-0x000001FDB6BE1000-memory.dmp
memory/4600-56-0x000001FDB6BE0000-0x000001FDB6BE1000-memory.dmp
memory/4600-92-0x000001FDB6BC0000-0x000001FDB6BC8000-memory.dmp
memory/4788-78-0x0000000000FD0000-0x000000000104C000-memory.dmp
memory/4788-102-0x0000000000FD0000-0x000000000104C000-memory.dmp
memory/4788-183-0x0000000000FD0000-0x000000000104C000-memory.dmp
memory/4976-91-0x0000000002A40000-0x0000000002ABC000-memory.dmp
memory/5016-0-0x0000000000416000-0x0000000000417000-memory.dmp
memory/5016-9-0x00000000032F0000-0x000000000336C000-memory.dmp