3dd0b05a8d5272d9a7f68df76d8c7db1e460e22103647153c9d4998a120bc81f

Analysis

max time kernel
299s
max time network
306s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RubyCraftSMP-Launcher.exe
Size 172.1MB
Sample260705-ptfczacv7v
SHA256 3dd0b05a8d5272d9a7f68df76d8c7db1e460e22103647153c9d4998a120bc81f
MD5 152ccde74c87e86ad7be88bcd68963c3
SHA1 3f3824d05f83acb22dd79b3e35d129748b8eea4c
SHA512 be1b3002998ea19fdd305df98e283c395feab2ae619309ee3f27232f926581aaf703d15fc7ed169945e62d72068693bc403f04b84d27c0a33ecaebef3ae3b421
SSDEEP 1572864:iasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:K4fc/M+i6xCL
TLSH
T1F6888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	discord.com
1	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
4	api.ipify.org

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe
4292	javaw.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	4292	javaw.exe
Token: SeIncBasePriorityPrivilege	4292	javaw.exe
Token: SeDebugPrivilege	4292	javaw.exe
Token: SeDebugPrivilege	4292	javaw.exe
Token: SeDebugPrivilege	4292	javaw.exe
Token: SeDebugPrivilege	4292	javaw.exe
Token: SeDebugPrivilege	4292	javaw.exe
Token: SeDebugPrivilege	4292	javaw.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 2404	3880	RubyCraftSMP-Launcher.exe	81
PID 3880 wrote to memory of 2404	3880	RubyCraftSMP-Launcher.exe	81
PID 3880 wrote to memory of 4292	3880	RubyCraftSMP-Launcher.exe	82
PID 4292 wrote to memory of 4680	4292	javaw.exe	83
PID 4292 wrote to memory of 4680	4292	javaw.exe	83
PID 4292 wrote to memory of 1748	4292	javaw.exe	84
PID 4292 wrote to memory of 1748	4292	javaw.exe	84
PID 4292 wrote to memory of 4040	4292	javaw.exe	85
PID 4292 wrote to memory of 4040	4292	javaw.exe	85
PID 4292 wrote to memory of 3428	4292	javaw.exe	86
PID 4292 wrote to memory of 3428	4292	javaw.exe	86
PID 4292 wrote to memory of 232	4292	javaw.exe	87
PID 4292 wrote to memory of 232	4292	javaw.exe	87
PID 4292 wrote to memory of 4964	4292	javaw.exe	88
PID 4292 wrote to memory of 4964	4292	javaw.exe	88

C:\Users\Admin\AppData\Local\Temp\RubyCraftSMP-Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\RubyCraftSMP-Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\RubyCraftSMP-Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\RubyCraftSMP-Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RubyCraftSMP-Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1672,i,3544095043494681775,1719271900794519764,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1664 /prefetch:2
  2⤵
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\25b4a824f9b5.jar V ira-eb826af3::default
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ewa_vlt_13001233550527716977.db

Path C:\Users\Admin\AppData\Local\Temp\ewa_vlt_13001233550527716977.db
Size 20KB
SHA256 7d11fee0d0b047cabe5d8cd4ae5c1d38faa4a2891921e3c1f468f73b47409ae4
MD5 56ad4ce3c3c398ab63a185d6ceb9b2c4
SHA1 ce0c0beb49ec0a77b1888dc8f5639279bfcfa497
SHA512 5c309a6575ffbf8055b7a90fcd31793f8b3a077cbefaba8992e6fb73ceaaa2eb280655ccaab14074b1ce8522ab3d4e624a1db7cfb0965d84cb86d600592f3155
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5w0WbwbhuWUOCqj:TeW9aw/aHLopFMavU1iBQNHFWMAWnr
TLSH
T1AE92328F1F303610C4F48B36E9C2489B2E7C212C9327BAC8BE5454B29DD69ABF5055A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewa_vlt_3631905872248470718.db

Path C:\Users\Admin\AppData\Local\Temp\ewa_vlt_3631905872248470718.db
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewa_vlt_3783326097590349266.db

Path C:\Users\Admin\AppData\Local\Temp\ewa_vlt_3783326097590349266.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna17673787532179087655.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna17673787532179087655.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qvm3355925443950274980.dll

Path C:\Users\Admin\AppData\Local\Temp\qvm3355925443950274980.dll
Size 170KB
SHA256 d0b169a96386708a2d674d0aada1a1df48477a3457a18546e7830d362a9758f1
MD5 826e57757c1b03caaa82589ede492dbe
SHA1 60680a2290c9c3c0c0d3642082f41593c8aca8ac
SHA512 ca00544d099994340b0e429960f57bd4702d9dc756a06839a38a52d2f1b89a64f537d78b05b11f9a3287a8323cb9e033def4abf881c7920ea9d343f54478b268
SSDEEP 3072:pf/zPoA5vCQ/ATuAEEEx7b+sCHOIp+VOUm+k4biuERf7D6NQH41p/MKeJVyu7oq6:pfrrOTuAEFxPZIp+VO+bC36NQH41p/75
TLSH
T158045B176B875558D86AA0B8020B2543F8267C08433539F71797ECE52EB32B7263FB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.42.0.0-18b59f64-dfdc-43cd-83fb-b65fd4ed2d36-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.42.0.0-18b59f64-dfdc-43cd-83fb-b65fd4ed2d36-sqlitejdbc.dll
Size 913KB
SHA256 451e319b14cf9b35b99cca2d245e50e97205b7dcabeeccd8fec6bb54c8a2e84c
MD5 16d165c26c43d841b5ec73d8e0d6fc9d
SHA1 2673a2ed3c7e269abf2b3203cc5bcbb52031f93e
SHA512 694d5261d09a03e1967d41cba5f36a855a0fb9e4684b918ee35d62af9ff671635590f07f1a709de17b7672f2939cdd78f0c0e6c683e90762dbf9e12283c45686
SSDEEP 24576:2inz7OdTCU4Wn4g6eYo3iDU3Ck5bjVPqT39F:/8C84heY05qT3
TLSH
T1D2156C13E39344BDC87BC6B0871FE723B632F48A1134E94F6AA48B642E51E60975F758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\bin\jre\legal\java.net.http\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\bin\jre\legal\java.net.http\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\bin\jre\legal\java.net.http\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

memory/4292-378-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-386-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-125-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-372-0x00007FFD70A70000-0x00007FFD70B5C000-memory.dmp

Download

memory/4292-371-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-374-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-376-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-121-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-380-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-382-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-384-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-127-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-388-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-391-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-393-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-397-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-401-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-405-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-413-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-417-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-419-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-421-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download

memory/4292-423-0x000001E79A550000-0x000001E79B2F1000-memory.dmp

Download