Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 22:10
General
- Target Minecraft Checker/MCChecker.exe
- Size 22.9MB
- Sample261024-13vpssst7m
- SHA256 372437f1c9ad46a00f8d13490a8428bb5a3949c8f1188455442478d6934e9069
Malware Config
Signatures
- Loads dropped DLL 40 IoCs
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft Checker\MCChecker.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft Checker\MCChecker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Minecraft Checker\MCChecker.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft Checker\MCChecker.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command (Get-CimInstance -Class Win32_ComputerSystemProduct).UUID"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command (Get-CimInstance -Class Win32_ComputerSystemProduct).UUID4⤵
- Queries system WMI classes for hardware identifiers
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QtCore.pyd
QtGui.pyd
QtWidgets.pyd
Qt5Core.dll
Qt5Gui.dll
Qt5Widgets.dll
_bz2.pyd
_queue.pyd
_ssl.pyd
_uuid.pyd
md__mypyc.pyd
libcrypto-1_1.dll
libssl-1_1.dll
python3.dll
select.pyd
backend_c.pyd
__PSScriptPolicyTest_v0pzdczu.z3m.psm1
sip.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
md.pyd
msvcp140.dll
msvcp140_1.dll
python310.dll
silentroot_gui.dll
unicodedata.pyd
vcruntime140.dll
vcruntime140_1.dll
memory/1220-143-0x0000021099FF0000-0x000002109A00E000-memory.dmp
memory/1220-145-0x00000210FFE50000-0x00000210FFE5A000-memory.dmp
memory/1220-147-0x00000210FFEE0000-0x00000210FFF04000-memory.dmp
memory/1220-146-0x00000210FFEE0000-0x00000210FFF0A000-memory.dmp
memory/1220-144-0x000002109A090000-0x000002109A142000-memory.dmp
memory/1220-140-0x00000210FFE70000-0x00000210FFE92000-memory.dmp
memory/2732-135-0x00007FFBF1570000-0x00007FFBF17D5000-memory.dmp
memory/2732-126-0x00007FFBF2F40000-0x00007FFBF342C000-memory.dmp
memory/2732-127-0x00007FFBF29F0000-0x00007FFBF2F31000-memory.dmp
memory/2732-132-0x00007FFBF17E0000-0x00007FFBF1A43000-memory.dmp
memory/2732-151-0x00007FFBF3880000-0x00007FFBF49D8000-memory.dmp
memory/2732-150-0x00007FF6CC580000-0x00007FF6CDC9E000-memory.dmp
memory/4176-149-0x00007FF6CC580000-0x00007FF6CDC9E000-memory.dmp