Analysis

  • max time kernel
    397s
  • max time network
    362s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-05-2024 16:53

General

  • Target

    https://www.mediafire.com/file/cp5ko0ojvsrvcqx/RobloxBreaking.rar/file

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://www.mediafire.com/file/cp5ko0ojvsrvcqx/RobloxBreaking.rar/file"
    1⤵
      PID:3668
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4084
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:3104
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3600
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1868
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3232
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:2388
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:2792
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2392
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1332
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\RobloxBreaking.rar"
        1⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2492
      • C:\Users\Admin\Desktop\RobloxBreaking\RobloxBreaking.exe
        "C:\Users\Admin\Desktop\RobloxBreaking\RobloxBreaking.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2516
      • C:\Users\Admin\Desktop\RobloxBreaking\RobloxBreaking.exe
        "C:\Users\Admin\Desktop\RobloxBreaking\RobloxBreaking.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2488
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
          PID:2520
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4172
        • C:\Windows\system32\browser_broker.exe
          C:\Windows\system32\browser_broker.exe -Embedding
          1⤵
            PID:3572
          • C:\Windows\system32\browser_broker.exe
            C:\Windows\system32\browser_broker.exe -Embedding
            1⤵
              PID:4028

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

              Filesize

              4KB

              MD5

              1bfe591a4fe3d91b03cdf26eaacd8f89

              SHA1

              719c37c320f518ac168c86723724891950911cea

              SHA256

              9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

              SHA512

              02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

              Filesize

              2KB

              MD5

              7f38048a5b4bb647a43e93df970417c3

              SHA1

              f7022125ba74f50d0d4515ca0b47ccc88c2f47e1

              SHA256

              81d8c4d06be3654f64a49a2effb3606bb48a37556f4db38a524033d9949915bc

              SHA512

              06adc7711a98548c94954546a4a547b2547d63d1f26351a58e17d38b73c02e54823daf99d9aae8311225c02bf9e2f40bbb903ff6707c3ddaa64b1caafbbe342f

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7BUKSPQ\edgecompatviewlist[1].xml

              Filesize

              74KB

              MD5

              d4fc49dc14f63895d997fa4940f24378

              SHA1

              3efb1437a7c5e46034147cbbc8db017c69d02c31

              SHA256

              853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

              SHA512

              cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\4FBXA46K\www.mediafire[1].xml

              Filesize

              13B

              MD5

              c1ddea3ef6bbef3e7060a1a9ad89e4c5

              SHA1

              35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

              SHA256

              b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

              SHA512

              6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\4FBXA46K\www.mediafire[1].xml

              Filesize

              1KB

              MD5

              85983177f981bcea75045c90627e5a0b

              SHA1

              1b58b225ef9e80fa5311784246cc3df88e81a95e

              SHA256

              908e3f3a79a12a2b41bce4239667f48c072cf1b7c2fe6954bfaec77034269a39

              SHA512

              22828f5ad815bb534181af661c6d8790e3cc628be7f5e4190da224abd3332c20e02a4b25d6ebc9122b0d03a868b37525463e4c5f51a8d6ab6c8ee1bfd0f8ca8c

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

              Filesize

              392B

              MD5

              2294616baf8f8e24866c43dc1e89fcae

              SHA1

              f6c1bcde23c44ce1129102d0c5376b5acc46c484

              SHA256

              c3aa4b741682a07865b81d583ced6ad349b9efa080f7f02a6f079c7d49d9c9d0

              SHA512

              fa1a5d661465fb3f2506cc9a1187278c548c84ad836f32c7615883809dd223376edf301e03b8193a7519a1b2c2aa1ae067faa0cead783866b78899e61a80bbd6

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BT77CR44\favicon[1].ico

              Filesize

              10KB

              MD5

              a301c91c118c9e041739ad0c85dfe8c5

              SHA1

              039962373b35960ef2bb5fbbe3856c0859306bf7

              SHA256

              cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f

              SHA512

              3a5a2801e0556c96574d8ab5782fc5eab0be2af7003162da819ac99e0737c8876c0db7b42bb7c149c4f4d9cfe61d2878ff1945017708f5f7254071f342a6880a

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PY8B3V2Z\suggestions[1].en-US

              Filesize

              17KB

              MD5

              5a34cb996293fde2cb7a4ac89587393a

              SHA1

              3c96c993500690d1a77873cd62bc639b3a10653f

              SHA256

              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

              SHA512

              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\V8HI4V2O\RobloxBreaking[1].rar

              Filesize

              80KB

              MD5

              5779108bac274be5498bda26a7adf863

              SHA1

              9c871d45bab1c057e4d4811312f47df834761986

              SHA256

              26b4eeaa8cfd9027fef7d925ebe49259c6aff416e9abd9365e57cdd356da6cc1

              SHA512

              ec96f50e5877ff888c513ded7f46b73c885d8e28a5c368f6d699a20c513bf30cf59a562d238da83a30a8aa00fdfd1257bf166bf3ff99c8e46370b8cb1c965840

            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

              Filesize

              2KB

              MD5

              61d271a64b21b901ff7268b77029baec

              SHA1

              14b2e0cf0f7bba7851e48d23745346f1fed7b493

              SHA256

              fbd95b765c605f4f120e4aea938cc7feeed224bbc2c538e39e775f4199c8ce16

              SHA512

              c9b8c0819bfc18718a1bdcb4a1b331991c0f73c486d2d65638d0faf8cd4c07e0347a4d8e466298d7f7ce948998bf33e3f5c08b590b051a93870806f621184b15

            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

              Filesize

              488B

              MD5

              c3cace440a61a572f4b1eddde7a80f82

              SHA1

              5dab5df0407d4ea42c8404dd450ab53139308b87

              SHA256

              3b626ca8bd07c944cae7e0d2a2f78d7fbc7c81b0de201edfcd92fa50dca0ba5e

              SHA512

              01d2699a5ebc8f37ffd3db3eb6e3724f5b167cc58457e5416cf30c3cda172c4c45e71578a0022a99b678502ca6bcd414f7dfba6f20fa11a78093849ada1742f9

            • C:\Users\Admin\Desktop\RobloxBreaking\RobloxBreaking.exe

              Filesize

              493KB

              MD5

              93cb5abc6b899042035672ccf832e0b4

              SHA1

              1f2ae5be8bd068f2b2e05bf3e915cf57ca1c700c

              SHA256

              97017c568e537ac9bd31d3fb299d7d3c2cbf5ba6803c04263f1a0ef65a5c23ac

              SHA512

              324a16a6916f13a7f5c263913661cbf359e770bd1923b0ac93c695f5df7dce299c5ae1d1f01206f0f9688ef49342b44384df4f9d52a952712b00b68be575067f

            • C:\Users\Admin\Downloads\RobloxBreaking.rar.eoy4ieq.partial

              Filesize

              36.1MB

              MD5

              18ef976d53ed5f36ce195293433c7797

              SHA1

              8281a72ceeda936ee01cbb4fc6d5a9ef96be836e

              SHA256

              ab982bde5195cd0daee99faa03d4866671b5dd5de0bc5356c362383182b9c661

              SHA512

              79e57cc43ce25b758df6e3dff8466ed63fdf4c07b8e42c90f60aa2f4334afd9137f214d9c5e4ce109b2bc63f096a18675fdda2026c9828e23ef7cafd1746dfba

            • memory/1868-44-0x00000268FA8C0000-0x00000268FA9C0000-memory.dmp

              Filesize

              1024KB

            • memory/1868-43-0x00000268FA8C0000-0x00000268FA9C0000-memory.dmp

              Filesize

              1024KB

            • memory/2516-1974-0x0000000006D10000-0x0000000006D86000-memory.dmp

              Filesize

              472KB

            • memory/2516-1962-0x0000000005110000-0x00000000051A2000-memory.dmp

              Filesize

              584KB

            • memory/2516-1961-0x0000000005570000-0x0000000005A6E000-memory.dmp

              Filesize

              5.0MB

            • memory/2516-1960-0x0000000000400000-0x000000000044A000-memory.dmp

              Filesize

              296KB

            • memory/2516-1963-0x0000000005100000-0x000000000510A000-memory.dmp

              Filesize

              40KB

            • memory/2516-1964-0x0000000006600000-0x0000000006C06000-memory.dmp

              Filesize

              6.0MB

            • memory/2516-1965-0x0000000006180000-0x000000000628A000-memory.dmp

              Filesize

              1.0MB

            • memory/2516-1966-0x00000000060B0000-0x00000000060C2000-memory.dmp

              Filesize

              72KB

            • memory/2516-1967-0x0000000006110000-0x000000000614E000-memory.dmp

              Filesize

              248KB

            • memory/2516-1968-0x0000000006290000-0x00000000062DB000-memory.dmp

              Filesize

              300KB

            • memory/2516-1973-0x00000000063A0000-0x0000000006406000-memory.dmp

              Filesize

              408KB

            • memory/2516-1975-0x0000000006570000-0x000000000658E000-memory.dmp

              Filesize

              120KB

            • memory/2516-1976-0x00000000080B0000-0x0000000008272000-memory.dmp

              Filesize

              1.8MB

            • memory/2516-1977-0x00000000087B0000-0x0000000008CDC000-memory.dmp

              Filesize

              5.2MB

            • memory/3232-221-0x0000026EF0BA0000-0x0000026EF0BA2000-memory.dmp

              Filesize

              8KB

            • memory/3232-248-0x0000026EF1D40000-0x0000026EF1D60000-memory.dmp

              Filesize

              128KB

            • memory/3232-503-0x0000026EDBD20000-0x0000026EDBD30000-memory.dmp

              Filesize

              64KB

            • memory/3232-502-0x0000026EDBD20000-0x0000026EDBD30000-memory.dmp

              Filesize

              64KB

            • memory/3232-501-0x0000026EDBD20000-0x0000026EDBD30000-memory.dmp

              Filesize

              64KB

            • memory/3232-506-0x0000026EDBD20000-0x0000026EDBD30000-memory.dmp

              Filesize

              64KB

            • memory/3232-507-0x0000026EDBD20000-0x0000026EDBD30000-memory.dmp

              Filesize

              64KB

            • memory/3232-505-0x0000026EDBD20000-0x0000026EDBD30000-memory.dmp

              Filesize

              64KB

            • memory/3232-318-0x0000026EED330000-0x0000026EED332000-memory.dmp

              Filesize

              8KB

            • memory/3232-228-0x0000026EF12F0000-0x0000026EF12F2000-memory.dmp

              Filesize

              8KB

            • memory/3232-230-0x0000026EF13F0000-0x0000026EF13F2000-memory.dmp

              Filesize

              8KB

            • memory/3232-61-0x0000026EDC010000-0x0000026EDC110000-memory.dmp

              Filesize

              1024KB

            • memory/3232-69-0x0000026EDBD60000-0x0000026EDBD62000-memory.dmp

              Filesize

              8KB

            • memory/3232-504-0x0000026EDBD20000-0x0000026EDBD30000-memory.dmp

              Filesize

              64KB

            • memory/3232-232-0x0000026EF1460000-0x0000026EF1462000-memory.dmp

              Filesize

              8KB

            • memory/3232-234-0x0000026EF1500000-0x0000026EF1502000-memory.dmp

              Filesize

              8KB

            • memory/3232-218-0x0000026EF0B90000-0x0000026EF0B92000-memory.dmp

              Filesize

              8KB

            • memory/3232-67-0x0000026EDBD40000-0x0000026EDBD42000-memory.dmp

              Filesize

              8KB

            • memory/3232-225-0x0000026EF0BE0000-0x0000026EF0BE2000-memory.dmp

              Filesize

              8KB

            • memory/3232-223-0x0000026EF0BC0000-0x0000026EF0BC2000-memory.dmp

              Filesize

              8KB

            • memory/3232-216-0x0000026EEDEF0000-0x0000026EEDEF2000-memory.dmp

              Filesize

              8KB

            • memory/3232-204-0x0000026EEE6E0000-0x0000026EEE7E0000-memory.dmp

              Filesize

              1024KB

            • memory/3232-64-0x0000026EDBD10000-0x0000026EDBD12000-memory.dmp

              Filesize

              8KB

            • memory/4084-0-0x00000186DE220000-0x00000186DE230000-memory.dmp

              Filesize

              64KB

            • memory/4084-253-0x00000186E4890000-0x00000186E4891000-memory.dmp

              Filesize

              4KB

            • memory/4084-254-0x00000186E48A0000-0x00000186E48A1000-memory.dmp

              Filesize

              4KB

            • memory/4084-35-0x00000186DB650000-0x00000186DB652000-memory.dmp

              Filesize

              8KB

            • memory/4084-16-0x00000186DE320000-0x00000186DE330000-memory.dmp

              Filesize

              64KB