Analysis
- max time kernel
270s - max time network
225s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
24/04/2023, 16:41
Behavioral task
behavioral1
Sample
Roblox Robux Generator.exe
Resource
win7-20230220-en
windows7-x64
7 signatures
150 seconds
General
- Target Roblox Robux Generator.exe
- Size 47KB
- Sample230424-t63fgsdb72
- SHA256 8d04e75201191a19e860e4d9b32b0728c82b92cb75b0a7aea28a0c54d75f3f06
- MD5 b1488d908216331e393bbfc12b232043
- SHA1 fb19aa22e04f5d128e1a174960f8d0377d1cbc80
- SHA512 6245951d37f15c5ee39d7708dba54d5155bfb8c79f2e9456cf0ca84ae5a6ea636345a79192545f87f1f2227998140b432b96caabaac78778d73724a484ab4380
- SSDEEP 768:Td3PjILweUc+biMtelDSN+iV08Ybyge+0MvEgK/JnZVc6KN:Td39kMtKDs4zb1KMnkJnZVclN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
1.0.7
Botnet
-
Default
C2
-
127.0.0.1:8848
-
127.0.0.1:1604
-
127.0.0.1:13033
-
0.tcp.eu.ngrok.io:8848
-
0.tcp.eu.ngrok.io:1604
-
0.tcp.eu.ngrok.io:13033
Mutex
-
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3524-133-0x0000000000640000-0x0000000000652000-memory.dmp asyncrat - Program crash 1 IoCs
pid pid_target Process procid_target 228 3524 WerFault.exe 84 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1800 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1800 taskmgr.exe Token: SeSystemProfilePrivilege 1800 taskmgr.exe Token: SeCreateGlobalPrivilege 1800 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Robux Generator.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Robux Generator.exe"1⤵PID:3524
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3524 -s 10882⤵
- Program crash
PID:228
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1800
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 3524 -ip 35241⤵PID:4532