Analysis
-
max time kernel
42s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 10:38
Behavioral task
behavioral1
Sample
Robloxexecutorerrorfix.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
300 seconds
General
-
Target
Robloxexecutorerrorfix.exe
-
Size
74KB
-
MD5
5bc409623f3a7f76c2e3466991c74661
-
SHA1
0d0594dc02f459fb7812b33674f001f4cdd9a760
-
SHA256
33a54a05ebc11facb6e193c56bd39a852330ef3aea24760b590c631bbc93ec3e
-
SHA512
abe6e1686517095a1caa2074531dc817cd5de1c12c83f998215010a242ebd1d280904580b2015f9ce256f4b8c97d795aa747e56f793c0250f6ad8327becbe856
-
SSDEEP
1536:xUIccxswYCV6PMVaWjvIUH1bw/6cra95QzcGKVclN:xU1cxsny6PMVaWhH1bwCT5QfYY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
212.132.117.91:4449
Mutex
Stsrem2123
Attributes
-
delay
1
-
install
true
-
install_file
Sysdataimportant.exe
-
install_folder
%Temp%
aes.plain
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeIncreaseQuotaPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSecurityPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeTakeOwnershipPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeLoadDriverPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSystemProfilePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSystemtimePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeProfSingleProcessPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeIncBasePriorityPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeCreatePagefilePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeBackupPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeRestorePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeShutdownPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeDebugPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSystemEnvironmentPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeRemoteShutdownPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeUndockPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeManageVolumePrivilege 3932 Robloxexecutorerrorfix.exe Token: 33 3932 Robloxexecutorerrorfix.exe Token: 34 3932 Robloxexecutorerrorfix.exe Token: 35 3932 Robloxexecutorerrorfix.exe Token: 36 3932 Robloxexecutorerrorfix.exe Token: SeIncreaseQuotaPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSecurityPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeTakeOwnershipPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeLoadDriverPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSystemProfilePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSystemtimePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeProfSingleProcessPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeIncBasePriorityPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeCreatePagefilePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeBackupPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeRestorePrivilege 3932 Robloxexecutorerrorfix.exe Token: SeShutdownPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeDebugPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeSystemEnvironmentPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeRemoteShutdownPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeUndockPrivilege 3932 Robloxexecutorerrorfix.exe Token: SeManageVolumePrivilege 3932 Robloxexecutorerrorfix.exe Token: 33 3932 Robloxexecutorerrorfix.exe Token: 34 3932 Robloxexecutorerrorfix.exe Token: 35 3932 Robloxexecutorerrorfix.exe Token: 36 3932 Robloxexecutorerrorfix.exe Token: SeDebugPrivilege 508 taskmgr.exe Token: SeSystemProfilePrivilege 508 taskmgr.exe Token: SeCreateGlobalPrivilege 508 taskmgr.exe Token: 33 508 taskmgr.exe Token: SeIncBasePriorityPrivilege 508 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe 508 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Robloxexecutorerrorfix.exe"C:\Users\Admin\AppData\Local\Temp\Robloxexecutorerrorfix.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:508