Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2023 12:41

General

  • Target

    RobloxCheatInjector.exe

  • Size

    13.4MB

  • MD5

    f5340a79f33a55311010574d013bb17c

  • SHA1

    1552381ccf239d85c1431509713784dc420aa674

  • SHA256

    09766b3da2146a553aba42fbaad1694e2e4996dd6d488c2e32bf85429d4852d0

  • SHA512

    42f3a21ab1679c534900660acf17c49bc9ce7f9cffb37b259a1d580980a7de03d0177d453c163159695a19e9a0f71f8f0fe6ec26105618bb61b0bef2ce286fd8

  • SSDEEP

    3072:3GPqxRvWpV2rSEBLCjiV7ltx/qV/1nBIrsr+T1fAJmZkVTJbtZOyJSp8Bb8EGRf:G+JOIhiulXqV9idqo6TBf8EGh

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxCheatInjector.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxCheatInjector.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 632
      2⤵
      • Program crash
      PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    efe6c00edbcc4ce51a7bce68f14426be

    SHA1

    3ae2c9e2e4374994a3c7c70655e0ca863e1df3ba

    SHA256

    c3ad0d9ca43a2f521301880a685db7df18a054bdc5b716f290f61928e6729381

    SHA512

    552d13ad6f94ef7ec08ec0310541bdf188ad8b6b245db062e7605775da01b41eea51da8f2730a8a7ea2c186bed64d0a1655eaf014af895e331dbf9b140843782

  • C:\Users\Admin\AppData\Local\Temp\CabD6D1.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\TarD79F.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/1732-0-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB