Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
09/08/2026, 03:54
General
- Target Betacraft/Betacraft.exe
- Size 10.0MB
- Sample260809-ef831shj2s
- SHA256 71c66559e00822440a29ebe5509bceb71c005cdc482af327c461c6b18fb79b77
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Betacraft\Betacraft.exe"C:\Users\Admin\AppData\Local\Temp\Betacraft\Betacraft.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -version 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -version3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
English.json
settings.json
memory/3124-98-0x00007FFE38D30000-0x00007FFE38E37000-memory.dmp
memory/3124-97-0x00007FFE283B0000-0x00007FFE28A0C000-memory.dmp
memory/3124-1-0x00007FFE3F380000-0x00007FFE3F396000-memory.dmp
memory/3124-93-0x00007FFE29370000-0x00007FFE299AF000-memory.dmp
memory/3124-96-0x00007FFE38E40000-0x00007FFE39024000-memory.dmp
memory/3124-95-0x00007FFE28A10000-0x00007FFE29370000-memory.dmp
memory/3124-0-0x00007FFE43090000-0x00007FFE430A5000-memory.dmp
memory/3124-91-0x00007FF75E270000-0x00007FF76363C000-memory.dmp
memory/3124-101-0x00007FFE397A0000-0x00007FFE3981C000-memory.dmp
memory/3124-100-0x00007FFE3F380000-0x00007FFE3F396000-memory.dmp
memory/3124-99-0x00007FFE43090000-0x00007FFE430A5000-memory.dmp
memory/3124-94-0x0000000064940000-0x0000000064956000-memory.dmp
memory/3124-92-0x00007FFE433C0000-0x00007FFE433DA000-memory.dmp
memory/3568-60-0x000002D9045B0000-0x000002D9045B1000-memory.dmp