Analysis

  • max time kernel
    151s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/10/2026, 22:55

General

  • Target
    MCServerManager-win-Setup.exe
  • Size 84.5MB
  • Sample261022-2wlc8abf93
  • SHA256 557d29c573332ad96ea85394b43db64e3f0285db40151c21566a393a9f09aeb8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MCServerManager-win-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MCServerManager-win-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe
      "C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe" --veloapp-install 4.1.0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:6016
    • C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe
      "C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
        3⤵
          PID:3572
        • C:\Program Files\Java\jdk-1.8\bin\java.exe
          "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
          3⤵
            PID:2052
          • C:\Program Files\Java\jre-1.8\bin\java.exe
            "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
            3⤵
              PID:4420

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              DirectWriteForwarder.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\DirectWriteForwarder.dll
              • Size 470KB
              • SHA256 cc7a5409a37eed77a7ed5185620a733255492974bdb270745e0489d55a6b7823
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Mcsm.Core.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\Mcsm.Core.dll
              • Size 1.8MB
              • SHA256 dc153d6b18484de4ced0b22fa2397a132a68539b088fb3e11aae2ebfdd0c483c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Microsoft.Win32.Primitives.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\Microsoft.Win32.Primitives.dll
              • Size 15KB
              • SHA256 2ac29370b9734bfd2fac7ea4037d759e81b61b5863dfd416baffc2d60a8079a7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              NuGet.Versioning.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\NuGet.Versioning.dll
              • Size 63KB
              • SHA256 bfcba996b3fc59fbee4d67ae42cc86acae455cbe55119216cda2b84b4457256f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              PresentationCore.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\PresentationCore.dll
              • Size 7.9MB
              • SHA256 183905d574ad301fa8625cf971a0cf95b60fa5ab15167d9e9995a9322edef5d6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              PresentationFramework.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\PresentationFramework.dll
              • Size 15.1MB
              • SHA256 3af6d3f0471d1b366975fe29fa181ece7d2e65892a03b593439f733ad045c22a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ServerManagerForMinecraft.deps.json

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.deps.json
              • Size 41KB
              • SHA256 9ef0b4dab6a57c307c0d88d9efeca5f028cbfb75fc56a36b1a9a19cc9b10e662
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ServerManagerForMinecraft.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.dll
              • Size 4.2MB
              • SHA256 4af3748e5a4af9a649de439bc1992a78641fd813747a07154903a7e07e4f7a35
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ServerManagerForMinecraft.exe

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.exe
              • Size 191KB
              • SHA256 e7a6a3cf3f10bc161f4fa45f51faf998a83bb69b69d02ca46386265d820f19ea
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ServerManagerForMinecraft.runtimeconfig.json

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\ServerManagerForMinecraft.runtimeconfig.json
              • Size 594B
              • SHA256 cac2cca737b345020dcbb9df2eda4e68ecff23315f0bdcbd36bda5bd6549d811
              • MD5 SHA1 SHA512 TLSH

              System.Collections.NonGeneric.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Collections.NonGeneric.dll
              • Size 102KB
              • SHA256 b88f9c3ca6815b91061596e615df54ee5eb34cccef70245883a358f9f3090bf5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Collections.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Collections.dll
              • Size 290KB
              • SHA256 4dcfa26ab7a4983f2b7095d90180e6d1a669269f1ab7fdeb653553a8d778a034
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.ComponentModel.Primitives.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.ComponentModel.Primitives.dll
              • Size 78KB
              • SHA256 74a39a79e9e3782322aad1cd82d6299bac54f0a6bf60584560e00f60452cc746
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Diagnostics.Debug.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Diagnostics.Debug.dll
              • Size 15KB
              • SHA256 cddcfd9d0d18f5ec9a5359eee558b96ca7e559509ec7f5e361198b2f076e68bf
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Diagnostics.Process.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Diagnostics.Process.dll
              • Size 322KB
              • SHA256 ea51de08264f67cb31a6b1aa9cf00dd23bfbc38bd3355804fbbb21b0a766aa3b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Linq.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Linq.dll
              • Size 682KB
              • SHA256 049166628925a15b7cb7ff7ba4c952e2eac09da9a29b156d6a3bc1d1a32d3e84
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Memory.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Memory.dll
              • Size 158KB
              • SHA256 21a17ae4ee7e14e54347696500910bd233cdb08007447f744bb19da2e2310a2e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Private.CoreLib.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.CoreLib.dll
              • Size 15.3MB
              • SHA256 0ccec5e150fe6cf43d1f04f9365a5cf2c99f43f501410475340d088b32d48748
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Private.Uri.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.Uri.dll
              • Size 250KB
              • SHA256 392097e1bcd61974db2a085a43db5f57b82f3b2e295db471a30407c4026e0c3b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Private.Xml.Linq.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.Xml.Linq.dll
              • Size 382KB
              • SHA256 dbe4ddf972a6918299673e6f43af9d365e9784a8e40035ba7afdc7cba5527db7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Private.Xml.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Private.Xml.dll
              • Size 7.4MB
              • SHA256 3c866e68c0b3eacd69851ca65e1633488dd5ed2d10233e51026d93522a9e3e56
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Runtime.CompilerServices.VisualC.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.CompilerServices.VisualC.dll
              • Size 30KB
              • SHA256 0a087afdf85723e622c97bdc3f08accaea2fe6af23f1e84c75064607dd3a8dc7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Runtime.Extensions.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.Extensions.dll
              • Size 17KB
              • SHA256 fb5c3a7854ab0fa57c89f0dc16f8a6f756bfb9297a5037b04def73fca39b033f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Runtime.InteropServices.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.InteropServices.dll
              • Size 110KB
              • SHA256 62b6669d9970f333ca66c45a5a2e6084ea1e87540c49e8ec0c1f19910fda207d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Runtime.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Runtime.dll
              • Size 44KB
              • SHA256 c5839cad9c86b59c75475bd2cd13cdfa3eab3c6a74e6ad9041c5bb82a91d57b1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Text.Encoding.Extensions.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Text.Encoding.Extensions.dll
              • Size 15KB
              • SHA256 60d75d0b3467b637e8fc3cf7f56f40e64cc38022bbddebba80ef3a39fac2932f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Threading.Thread.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Threading.Thread.dll
              • Size 15KB
              • SHA256 4c98643005da343011cf2b70a168223173f0df597f11fece0acc1355d3617257
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Threading.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Threading.dll
              • Size 82KB
              • SHA256 9faa4d24cf6a8782aa77215b03bda1108f5ffc60dbf825bf8988d901b5d87a41
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Xaml.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Xaml.dll
              • Size 1.3MB
              • SHA256 781b3852cbf086e5389968601087a2c9cbc3184375fb8b68ecca243dd0e06f82
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Xml.ReaderWriter.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Xml.ReaderWriter.dll
              • Size 21KB
              • SHA256 dbde2bf651ef0420bc5c2b26a19a141f10003d6cb3f6456a75c2fae9a827d463
              • MD5 SHA1 SHA512 SSDEEP TLSH

              System.Xml.XDocument.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\System.Xml.XDocument.dll
              • Size 15KB
              • SHA256 c6c40f525b4de181cf86ef2c75c7ba3a38edb5676932556bb1fb32eb9032bd28
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Velopack.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\Velopack.dll
              • Size 268KB
              • SHA256 bde31bef4aa010ac2efa23d120d06ff7ea61b256a6f6eee0d295501aa7d3bd7b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              WindowsBase.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\WindowsBase.dll
              • Size 2.1MB
              • SHA256 5623c6fbdf1a2104a88f66c654b8a5ee836d47dfb1223f3f3c9d4ccca307c9e0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              clrjit.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\clrjit.dll
              • Size 2.0MB
              • SHA256 a570cf82e47b74847821da210410bf7959a4fe5d421e9d74c20f95ade54f8dca
              • MD5 SHA1 SHA512 SSDEEP TLSH

              coreclr.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\coreclr.dll
              • Size 4.4MB
              • SHA256 eeca161055e8f6547c51348acaeb106c43ed661cbd24aee92510d2d36d475edd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              hostfxr.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\hostfxr.dll
              • Size 371KB
              • SHA256 4dd83895ffada7fd873b0cc70335d993ed821a68d954b8cbfffd4f1483f81c90
              • MD5 SHA1 SHA512 SSDEEP TLSH

              hostpolicy.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\hostpolicy.dll
              • Size 370KB
              • SHA256 3e0bdef9416a0c798b304b636f1bfabf469198016af10b9d6a769ff0c9eec76f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              netstandard.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\netstandard.dll
              • Size 98KB
              • SHA256 4922ed9efb749c604bdb18f777627ecd104a2f02d78064120a81f5f055fd7ee3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              sq.version

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\sq.version
              • Size 525B
              • SHA256 c6d0520b950affff73163f4afb2bfaf8a4c712ba2fd3634bad80669a5b1b2ef7
              • MD5 SHA1 SHA512 TLSH

              vcruntime140_cor3.dll

              • Path C:\Users\Admin\AppData\Local\MCServerManager\current\vcruntime140_cor3.dll
              • Size 121KB
              • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
              • MD5 SHA1 SHA512 SSDEEP TLSH

              app-settings.json

              • Path C:\Users\Admin\AppData\Roaming\MCServerManager\app-settings.json
              • Size 771B
              • SHA256 6b98d400b21a784ba80180f20e48470d723afe9b95d2af4fb99b0ac3e7830df5
              • MD5 SHA1 SHA512 TLSH

              app-2026-10-22_23-56-51.log

              • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
              • Size 867B
              • SHA256 7a2e1fcef636682e2222ab2deefaab590b4112bd62b2895934114eb7d302234b
              • MD5 SHA1 SHA512 TLSH

              app-2026-10-22_23-56-51.log

              • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
              • Size 1KB
              • SHA256 208e4e3d852ce55971559a609d9484b04f55be3f0942d68d66f676ab5623110f
              • MD5 SHA1 SHA512 TLSH

              app-2026-10-22_23-56-51.log

              • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
              • Size 1KB
              • SHA256 ba73d06c62faa8333df4cfe09db25767c79cfa8d1c0cdcf3ea43096d211f9589
              • MD5 SHA1 SHA512 TLSH

              app-2026-10-22_23-56-51.log

              • Path C:\Users\Admin\AppData\Roaming\MCServerManager\logs\app-2026-10-22_23-56-51.log
              • Size 2KB
              • SHA256 aa99b09ce903d2a984e025bdc656d0fffba43ef0d0eb6d3b7f1b83677c88177a
              • MD5 SHA1 SHA512 TLSH

              memory/2052-622-0x00000251AF430000-0x00000251AF431000-memory.dmp

              memory/3572-607-0x0000021309470000-0x0000021309471000-memory.dmp

              memory/4420-634-0x00000296BB370000-0x00000296BB371000-memory.dmp