Analysis
- max time kernel
454s - max time network
461s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
11/05/2024, 00:16
Behavioral task
behavioral1
Sample
RoleplayGames.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
1800 seconds
General
- Target RoleplayGames.exe
- Size 40.0MB
- Sample240511-akmncsab31
- SHA256 0c051fe7ad2d5bbd4455036091af49d695495912a9855a8b75f4f70f74f0d281
- MD5 5acd6dc984c38aeae381e1b373c83ece
- SHA1 70a47d327f2bdd4002d282e347da45061ff35049
- SHA512 aa76b5413de7f66d49a9edb569450dfcb378dc3b9533a3e27b46a6e7779fe22a81fe6ba8efd7cb9e0a90e586cfb28df4b001dc74f0d097888e337e8306a7b880
- SSDEEP 393216:21Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfW:2Mguj8Q4VfvKqFTrYh11M
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RoleplayGame.exe RoleplayGames.exe - Loads dropped DLL 2 IoCs
pid Process 4628 RoleplayGames.exe 4628 RoleplayGames.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 1 discord.com - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 9 api.ipify.org - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2156 tasklist.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4628 RoleplayGames.exe 4628 RoleplayGames.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1312 WMIC.exe Token: SeSecurityPrivilege 1312 WMIC.exe Token: SeTakeOwnershipPrivilege 1312 WMIC.exe Token: SeLoadDriverPrivilege 1312 WMIC.exe Token: SeSystemProfilePrivilege 1312 WMIC.exe Token: SeSystemtimePrivilege 1312 WMIC.exe Token: SeProfSingleProcessPrivilege 1312 WMIC.exe Token: SeIncBasePriorityPrivilege 1312 WMIC.exe Token: SeCreatePagefilePrivilege 1312 WMIC.exe Token: SeBackupPrivilege 1312 WMIC.exe Token: SeRestorePrivilege 1312 WMIC.exe Token: SeShutdownPrivilege 1312 WMIC.exe Token: SeDebugPrivilege 1312 WMIC.exe Token: SeSystemEnvironmentPrivilege 1312 WMIC.exe Token: SeRemoteShutdownPrivilege 1312 WMIC.exe Token: SeUndockPrivilege 1312 WMIC.exe Token: SeManageVolumePrivilege 1312 WMIC.exe Token: 33 1312 WMIC.exe Token: 34 1312 WMIC.exe Token: 35 1312 WMIC.exe Token: 36 1312 WMIC.exe Token: SeIncreaseQuotaPrivilege 1312 WMIC.exe Token: SeSecurityPrivilege 1312 WMIC.exe Token: SeTakeOwnershipPrivilege 1312 WMIC.exe Token: SeLoadDriverPrivilege 1312 WMIC.exe Token: SeSystemProfilePrivilege 1312 WMIC.exe Token: SeSystemtimePrivilege 1312 WMIC.exe Token: SeProfSingleProcessPrivilege 1312 WMIC.exe Token: SeIncBasePriorityPrivilege 1312 WMIC.exe Token: SeCreatePagefilePrivilege 1312 WMIC.exe Token: SeBackupPrivilege 1312 WMIC.exe Token: SeRestorePrivilege 1312 WMIC.exe Token: SeShutdownPrivilege 1312 WMIC.exe Token: SeDebugPrivilege 1312 WMIC.exe Token: SeSystemEnvironmentPrivilege 1312 WMIC.exe Token: SeRemoteShutdownPrivilege 1312 WMIC.exe Token: SeUndockPrivilege 1312 WMIC.exe Token: SeManageVolumePrivilege 1312 WMIC.exe Token: 33 1312 WMIC.exe Token: 34 1312 WMIC.exe Token: 35 1312 WMIC.exe Token: 36 1312 WMIC.exe Token: SeIncreaseQuotaPrivilege 228 WMIC.exe Token: SeSecurityPrivilege 228 WMIC.exe Token: SeTakeOwnershipPrivilege 228 WMIC.exe Token: SeLoadDriverPrivilege 228 WMIC.exe Token: SeSystemProfilePrivilege 228 WMIC.exe Token: SeSystemtimePrivilege 228 WMIC.exe Token: SeProfSingleProcessPrivilege 228 WMIC.exe Token: SeIncBasePriorityPrivilege 228 WMIC.exe Token: SeCreatePagefilePrivilege 228 WMIC.exe Token: SeBackupPrivilege 228 WMIC.exe Token: SeRestorePrivilege 228 WMIC.exe Token: SeShutdownPrivilege 228 WMIC.exe Token: SeDebugPrivilege 228 WMIC.exe Token: SeSystemEnvironmentPrivilege 228 WMIC.exe Token: SeRemoteShutdownPrivilege 228 WMIC.exe Token: SeUndockPrivilege 228 WMIC.exe Token: SeManageVolumePrivilege 228 WMIC.exe Token: 33 228 WMIC.exe Token: 34 228 WMIC.exe Token: 35 228 WMIC.exe Token: 36 228 WMIC.exe Token: SeIncreaseQuotaPrivilege 228 WMIC.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4628 wrote to memory of 1196 4628 RoleplayGames.exe 77 PID 4628 wrote to memory of 1196 4628 RoleplayGames.exe 77 PID 1196 wrote to memory of 1312 1196 cmd.exe 79 PID 1196 wrote to memory of 1312 1196 cmd.exe 79 PID 4628 wrote to memory of 2912 4628 RoleplayGames.exe 81 PID 4628 wrote to memory of 2912 4628 RoleplayGames.exe 81 PID 2912 wrote to memory of 228 2912 cmd.exe 83 PID 2912 wrote to memory of 228 2912 cmd.exe 83 PID 4628 wrote to memory of 1440 4628 RoleplayGames.exe 84 PID 4628 wrote to memory of 1440 4628 RoleplayGames.exe 84 PID 1440 wrote to memory of 1632 1440 cmd.exe 86 PID 1440 wrote to memory of 1632 1440 cmd.exe 86 PID 4628 wrote to memory of 1888 4628 RoleplayGames.exe 87 PID 4628 wrote to memory of 1888 4628 RoleplayGames.exe 87 PID 1888 wrote to memory of 4908 1888 cmd.exe 89 PID 1888 wrote to memory of 4908 1888 cmd.exe 89 PID 4628 wrote to memory of 3040 4628 RoleplayGames.exe 90 PID 4628 wrote to memory of 3040 4628 RoleplayGames.exe 90 PID 3040 wrote to memory of 4708 3040 cmd.exe 92 PID 3040 wrote to memory of 4708 3040 cmd.exe 92 PID 4628 wrote to memory of 2408 4628 RoleplayGames.exe 93 PID 4628 wrote to memory of 2408 4628 RoleplayGames.exe 93 PID 2408 wrote to memory of 3880 2408 cmd.exe 95 PID 2408 wrote to memory of 3880 2408 cmd.exe 95 PID 4628 wrote to memory of 4452 4628 RoleplayGames.exe 96 PID 4628 wrote to memory of 4452 4628 RoleplayGames.exe 96 PID 4452 wrote to memory of 3252 4452 cmd.exe 98 PID 4452 wrote to memory of 3252 4452 cmd.exe 98 PID 4628 wrote to memory of 3428 4628 RoleplayGames.exe 99 PID 4628 wrote to memory of 3428 4628 RoleplayGames.exe 99 PID 3428 wrote to memory of 1664 3428 cmd.exe 101 PID 3428 wrote to memory of 1664 3428 cmd.exe 101 PID 4628 wrote to memory of 4912 4628 RoleplayGames.exe 102 PID 4628 wrote to memory of 4912 4628 RoleplayGames.exe 102 PID 4912 wrote to memory of 2156 4912 cmd.exe 104 PID 4912 wrote to memory of 2156 4912 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\RoleplayGames.exe"C:\Users\Admin\AppData\Local\Temp\RoleplayGames.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory"2⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model,manufacturer /format:list"2⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model,manufacturer /format:list3⤵PID:1632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵PID:4908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"2⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵PID:4708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path SoftwareLicensingService get OA3xOriginalProductKey"2⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get OA3xOriginalProductKey3⤵PID:3880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get freespace"2⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get freespace3⤵PID:3252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get size"2⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get size3⤵PID:1664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:2156
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\history.db
- Size 152KB
- SHA256 aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
- MD5 73bd1e15afb04648c24593e8ba13e983
- SHA1 4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
- SHA512 6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
- SSDEEP 96:+WiseU+bF+UIYysX0QQycu5yZoLtrV0N3LjLqLk0e9:+vQ+bF+UI3i7cayZudV0R3qLkj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\webdata.db
- Size 100KB
- SHA256 e9da28248aba48d8819297a64e9913217778aca459a00eb829241601fa3111db
- MD5 b5a2b7cd14930f21483dde89c8ab1c34
- SHA1 85e7f62baa7218d9d86e83ca84f1f583354b7f6c
- SHA512 86a5c97bdfc4301223a39595b87c9695a5229114e3c6c9115f5386380451a3908e358aa0a5ba55ad7b74d952e57a5debcea4b119a9decfe96636b1e27ec1d734
- SSDEEP 192:L/UbavrNdV9bH9ITj8bGpnYANq6VGM6bIVumq:TAavrbV9D9knYANq69KIVumq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\history.db
- Size 116KB
- SHA256 c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1
- MD5 4e2922249bf476fb3067795f2fa5e794
- SHA1 d2db6b2759d9e650ae031eb62247d457ccaa57d2
- SHA512 8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da
- SSDEEP 96:Q/WU+bDoYysX0uhnydVjN9DLjGQLBE3u:Q/l+bDo3irhnydVj3XBBE3u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db
- Size 112KB
- SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
- MD5 87210e9e528a4ddb09c6b671937c79c6
- SHA1 3c75314714619f5b55e25769e0985d497f0062f2
- SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
- SSDEEP 192:EAogLUJAIH9IqR2nrQTjHbRmn8HKuqrTPGTATVumQ6:EAofJAa9Ijnh8HKuqrTxVumQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\pkg\061be8d448340efa3e2a5695f1ac1b14067edaebc342c00d5c206f2e77b84f1a\better_sqlite3.node
- Size 2.6MB
- SHA256 061be8d448340efa3e2a5695f1ac1b14067edaebc342c00d5c206f2e77b84f1a
- MD5 7a7b6e4a0573aa889fbac53b8794d264
- SHA1 6c37123b03cfffc8456c23d77afaa0cbbecedf18
- SHA512 e7031125ad83d063c3463634111edd7f72bb44766c781e769df6c6ea753240ae25aabf0c28b5ac938a724e2f69b6f858fa59ea5f3b50035160b06f05575a7b04
- SSDEEP 49152:a3AXkkYoKUxSwT+3P071fRTdW8xtsDVX:PrRhv/oX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\pkg\8cb967f152f6edacf2dd9771b6bd928a648c71807483f735e45d6512857ae21b\node-dpapi.node
- Size 141KB
- SHA256 8cb967f152f6edacf2dd9771b6bd928a648c71807483f735e45d6512857ae21b
- MD5 b2c5617b9f7de9cd133e263086d2bd3f
- SHA1 9e461b0297903dbe2523e3ad6d38209e2ea68701
- SHA512 33e04b883dc9711220870c30f726da634c1bb65762a268c91f4bc8606264ec24c1e54fd2664e8dbcc7beb334c4a6c1a846538b7c43b022e3cc5d80df4176357a
- SSDEEP 3072:s5fuWMqvwTfxOsTugpGgNjApj4PVQmA4m6:ozgOYu1ajOTS
- MD5 SHA1 SHA512 SSDEEP