cbd33d7ba3b8ef4562c696e1b70b5e71faded4cfb6b18b5f4c3d2eae20abf872

General

Target

NetflixCE V4/NetflixCE/RobloxStudio.exe
Size

16.1MB
MD5

8e6a15de31285c621f54e28f2a916234
SHA1

5d00229772679367c103cd38428aa9943bbeab10
SHA256

648397280c2b3660755a91900faccbc2f9431f891ae3ecccd8c54950abcaff11
SHA512

7b1b1f6fc3186db8752805f66baf846a9930a6edb516e312c381fe018a47be184f478e3f604a41a7d76d42ff1b4bcd6463c8738d558aa9f806a6cf40dccdaee2
SSDEEP

393216:b3Z8A06vEQ3ITvzx46SxiILGRKuc3W/R8q:b3ZIzx46YNLRWpN

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 40 IoCs

Processes:

RobloxStudio.exe

description	ioc	process
File opened for modification	C:\Windows\System32\KERNELBASE.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\shcore.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\user32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\psapi.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	RobloxStudio.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\advapi32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\GDI32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\sechost.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\Wldp.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\combase.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\win32u.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\shell32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\ole32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\imm32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	RobloxStudio.exe

Drops file in Windows directory 1 IoCs

Processes:

RobloxStudio.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_792d1c772443f647\comctl32.dll	RobloxStudio.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RobloxStudio.exe

pid process

2260 RobloxStudio.exe
2260 RobloxStudio.exe
2260 RobloxStudio.exe
2260 RobloxStudio.exe

pid	process
2260	RobloxStudio.exe
2260	RobloxStudio.exe
2260	RobloxStudio.exe
2260	RobloxStudio.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

RobloxStudio.exe

description	pid	process
Token: SeDebugPrivilege	2260	RobloxStudio.exe
Token: SeTcbPrivilege	2260	RobloxStudio.exe
Token: SeTcbPrivilege	2260	RobloxStudio.exe
Token: SeLoadDriverPrivilege	2260	RobloxStudio.exe
Token: SeCreateGlobalPrivilege	2260	RobloxStudio.exe
Token: SeLockMemoryPrivilege	2260	RobloxStudio.exe
Token: 33	2260	RobloxStudio.exe
Token: SeSecurityPrivilege	2260	RobloxStudio.exe
Token: SeTakeOwnershipPrivilege	2260	RobloxStudio.exe
Token: SeManageVolumePrivilege	2260	RobloxStudio.exe
Token: SeBackupPrivilege	2260	RobloxStudio.exe
Token: SeCreatePagefilePrivilege	2260	RobloxStudio.exe
Token: SeShutdownPrivilege	2260	RobloxStudio.exe
Token: SeRestorePrivilege	2260	RobloxStudio.exe
Token: 33	2260	RobloxStudio.exe
Token: SeIncBasePriorityPrivilege	2260	RobloxStudio.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RobloxStudio.exe

pid process

2260 RobloxStudio.exe

pid	process
2260	RobloxStudio.exe

C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\RobloxStudio.exe
"C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\RobloxStudio.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-1-0x0000000006D30000-0x0000000006D31000-memory.dmp

Filesize
4KB

Download
memory/2260-0-0x0000000006D30000-0x0000000006D31000-memory.dmp

Filesize
4KB

Download
memory/2260-3-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/2260-5-0x0000000006D50000-0x0000000006D51000-memory.dmp

Filesize
4KB

Download
memory/2260-7-0x0000000006D60000-0x0000000006D61000-memory.dmp

Filesize
4KB

Download
memory/2260-9-0x0000000006D70000-0x0000000006D71000-memory.dmp

Filesize
4KB

Download
memory/2260-13-0x0000000006D70000-0x0000000006D71000-memory.dmp

Filesize
4KB

Download
memory/2260-15-0x0000000006D80000-0x0000000006D81000-memory.dmp

Filesize
4KB

Download
memory/2260-17-0x0000000006D80000-0x0000000006D81000-memory.dmp

Filesize
4KB

Download
memory/2260-19-0x0000000006D80000-0x0000000006D81000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads