Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 17:36
General
-
Target
Roblox Executor.exe
-
Size
231KB
-
MD5
5b89a3d1ad450da99b67aaa3317cefaa
-
SHA1
f7256fd6c764d20859b44f9d956a0bd11a2e47a4
-
SHA256
7e0b011691401cfc5a7baf2ec11766fc3556f9ec3c30ad58f321d0aa61dc6f1f
-
SHA512
ba3cc155768e48af1add8ffc43fc4e32d0580feaba50f6e621208a83a508a64f54fa4109d907970c24129c20fef92315a536a77b18ad34d23d77901b3b62f9de
-
SSDEEP
6144:xloZMNrIkd8g+EtXHkv/iD4p0edCg/7IUR0STTKhqb8e1mxQi:DoZmL+EP8p0edCg/7IUR0STTKgE
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4356-0-0x00000108386B0000-0x00000108386F0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1352 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 24 discord.com 25 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4012 wmic.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1352 powershell.exe 1352 powershell.exe 3304 powershell.exe 3304 powershell.exe 3476 powershell.exe 3476 powershell.exe 3000 powershell.exe 3000 powershell.exe 4412 powershell.exe 4412 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4356 Roblox Executor.exe Token: SeDebugPrivilege 1352 powershell.exe Token: SeDebugPrivilege 3304 powershell.exe Token: SeDebugPrivilege 3476 powershell.exe Token: SeDebugPrivilege 3000 powershell.exe Token: SeIncreaseQuotaPrivilege 868 wmic.exe Token: SeSecurityPrivilege 868 wmic.exe Token: SeTakeOwnershipPrivilege 868 wmic.exe Token: SeLoadDriverPrivilege 868 wmic.exe Token: SeSystemProfilePrivilege 868 wmic.exe Token: SeSystemtimePrivilege 868 wmic.exe Token: SeProfSingleProcessPrivilege 868 wmic.exe Token: SeIncBasePriorityPrivilege 868 wmic.exe Token: SeCreatePagefilePrivilege 868 wmic.exe Token: SeBackupPrivilege 868 wmic.exe Token: SeRestorePrivilege 868 wmic.exe Token: SeShutdownPrivilege 868 wmic.exe Token: SeDebugPrivilege 868 wmic.exe Token: SeSystemEnvironmentPrivilege 868 wmic.exe Token: SeRemoteShutdownPrivilege 868 wmic.exe Token: SeUndockPrivilege 868 wmic.exe Token: SeManageVolumePrivilege 868 wmic.exe Token: 33 868 wmic.exe Token: 34 868 wmic.exe Token: 35 868 wmic.exe Token: 36 868 wmic.exe Token: SeIncreaseQuotaPrivilege 868 wmic.exe Token: SeSecurityPrivilege 868 wmic.exe Token: SeTakeOwnershipPrivilege 868 wmic.exe Token: SeLoadDriverPrivilege 868 wmic.exe Token: SeSystemProfilePrivilege 868 wmic.exe Token: SeSystemtimePrivilege 868 wmic.exe Token: SeProfSingleProcessPrivilege 868 wmic.exe Token: SeIncBasePriorityPrivilege 868 wmic.exe Token: SeCreatePagefilePrivilege 868 wmic.exe Token: SeBackupPrivilege 868 wmic.exe Token: SeRestorePrivilege 868 wmic.exe Token: SeShutdownPrivilege 868 wmic.exe Token: SeDebugPrivilege 868 wmic.exe Token: SeSystemEnvironmentPrivilege 868 wmic.exe Token: SeRemoteShutdownPrivilege 868 wmic.exe Token: SeUndockPrivilege 868 wmic.exe Token: SeManageVolumePrivilege 868 wmic.exe Token: 33 868 wmic.exe Token: 34 868 wmic.exe Token: 35 868 wmic.exe Token: 36 868 wmic.exe Token: SeIncreaseQuotaPrivilege 4736 wmic.exe Token: SeSecurityPrivilege 4736 wmic.exe Token: SeTakeOwnershipPrivilege 4736 wmic.exe Token: SeLoadDriverPrivilege 4736 wmic.exe Token: SeSystemProfilePrivilege 4736 wmic.exe Token: SeSystemtimePrivilege 4736 wmic.exe Token: SeProfSingleProcessPrivilege 4736 wmic.exe Token: SeIncBasePriorityPrivilege 4736 wmic.exe Token: SeCreatePagefilePrivilege 4736 wmic.exe Token: SeBackupPrivilege 4736 wmic.exe Token: SeRestorePrivilege 4736 wmic.exe Token: SeShutdownPrivilege 4736 wmic.exe Token: SeDebugPrivilege 4736 wmic.exe Token: SeSystemEnvironmentPrivilege 4736 wmic.exe Token: SeRemoteShutdownPrivilege 4736 wmic.exe Token: SeUndockPrivilege 4736 wmic.exe Token: SeManageVolumePrivilege 4736 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4356 wrote to memory of 1352 4356 Roblox Executor.exe 82 PID 4356 wrote to memory of 1352 4356 Roblox Executor.exe 82 PID 4356 wrote to memory of 3304 4356 Roblox Executor.exe 84 PID 4356 wrote to memory of 3304 4356 Roblox Executor.exe 84 PID 4356 wrote to memory of 3476 4356 Roblox Executor.exe 87 PID 4356 wrote to memory of 3476 4356 Roblox Executor.exe 87 PID 4356 wrote to memory of 3000 4356 Roblox Executor.exe 90 PID 4356 wrote to memory of 3000 4356 Roblox Executor.exe 90 PID 4356 wrote to memory of 868 4356 Roblox Executor.exe 93 PID 4356 wrote to memory of 868 4356 Roblox Executor.exe 93 PID 4356 wrote to memory of 4736 4356 Roblox Executor.exe 96 PID 4356 wrote to memory of 4736 4356 Roblox Executor.exe 96 PID 4356 wrote to memory of 2568 4356 Roblox Executor.exe 98 PID 4356 wrote to memory of 2568 4356 Roblox Executor.exe 98 PID 4356 wrote to memory of 4412 4356 Roblox Executor.exe 100 PID 4356 wrote to memory of 4412 4356 Roblox Executor.exe 100 PID 4356 wrote to memory of 4012 4356 Roblox Executor.exe 102 PID 4356 wrote to memory of 4012 4356 Roblox Executor.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Executor.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Executor.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Roblox Executor.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:4012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
948B
MD5ab1214368d16125b5f97e5014a91cfd8
SHA173ecf983976ebaa0c27c6bddc8d956b27c934197
SHA25662030acdc8413f7658ed0e27c658ef635766c971862f777bea9dcb4a42c83955
SHA5127e9d0aa20c3ee9674e09b4b6ac0f95955ba047f8714d8d26915feb2e242f011af1fa5168aa18292f183dab46647fccd182d2ca02029fe6ffd3213d167c6cb440
-
Filesize
1KB
MD588be3bc8a7f90e3953298c0fdbec4d72
SHA1f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA5124fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c
-
Filesize
1KB
MD551c1a86aa41cec8f3e4f182946bdcb06
SHA1144e53419587ec3d71d9114414bd187e8be0ef9a
SHA25682777c72c215e8b1253ec2ec6fcc9f14fb49ad55e441f8803cffd8122755d27e
SHA512401610dfb65b843f5961d59e7f728af41ce33369bd65f0e7707db1554509909803011493c263b88aefea62f901c9ac3bc8994f2bbd7f996dd3d88431d6d4ef5d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82