Overview

overview

6

Static

static

1

RobloxPlay...er.exe

windows7-x64

6

RobloxPlay...er.exe

windows10-2004-x64

6

Resubmissions

10/04/2024, 13:28

240410-qq4rtsce2y 6

Sharing

Copy URL Twitter E-mail

General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    4.6MB

  • Sample

    240410-qq4rtsce2y

  • MD5

    1b57a241eed58ce47249a846f2391652

  • SHA1

    345999af03a6c515191d212a200fad24039100c1

  • SHA256

    25913bcf70e0a8447e3ae39294cb3c3be44f15dcbccc4a0cd2aa4538e5ecc0f1

  • SHA512

    870cc586696961c4de63643f264514140357cad1c9a4eaf9f1e631507c680359cdc760728afd46f6511155dc5c37b7c61dcd6825b185635aa0353fb18313a8c0

  • SSDEEP

    98304:qXv8fLneOI8A0vq1pmgKkt6paeVtBN0Y2ycun:ikL48flgdsBKxlS

Score
6/10
discoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      RobloxPlayerInstaller.exe

    • Size

      4.6MB

    • MD5

      1b57a241eed58ce47249a846f2391652

    • SHA1

      345999af03a6c515191d212a200fad24039100c1

    • SHA256

      25913bcf70e0a8447e3ae39294cb3c3be44f15dcbccc4a0cd2aa4538e5ecc0f1

    • SHA512

      870cc586696961c4de63643f264514140357cad1c9a4eaf9f1e631507c680359cdc760728afd46f6511155dc5c37b7c61dcd6825b185635aa0353fb18313a8c0

    • SSDEEP

      98304:qXv8fLneOI8A0vq1pmgKkt6paeVtBN0Y2ycun:ikL48flgdsBKxlS

    Score
    6/10
    discoveryevasionpersistencetrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks