General
-
Target
RobloxPlayerInstaller.exe
-
Size
5.4MB
-
Sample
240523-p4ngbsba3t
-
MD5
1f1ae0eb12231c472e7ab91a6df69b75
-
SHA1
3c0b44b3b18df2b9be602b551828b27604ef51fe
-
SHA256
4f62cee70845d868afed5b5ad66d7fdc582e6f9b6b69e6d5e9c52a1e24105b60
-
SHA512
470162197814bcefa52a24e1e88264827e4a6aaa0a110a41f35cd9c392bdcf6bd7deb25bf5c9ccbb994ba01b8a7851d7f5025ed5b9ad9f4ba94eabcf7f103abd
-
SSDEEP
98304:r3vj6u39OyzUjFE6g7U8CBtg/gRLhiKLCAemBG4UuldUa:Tl3pcJbg/aCABnU+
Static task
static1
Malware Config
Targets
-
-
Target
RobloxPlayerInstaller.exe
-
Size
5.4MB
-
MD5
1f1ae0eb12231c472e7ab91a6df69b75
-
SHA1
3c0b44b3b18df2b9be602b551828b27604ef51fe
-
SHA256
4f62cee70845d868afed5b5ad66d7fdc582e6f9b6b69e6d5e9c52a1e24105b60
-
SHA512
470162197814bcefa52a24e1e88264827e4a6aaa0a110a41f35cd9c392bdcf6bd7deb25bf5c9ccbb994ba01b8a7851d7f5025ed5b9ad9f4ba94eabcf7f103abd
-
SSDEEP
98304:r3vj6u39OyzUjFE6g7U8CBtg/gRLhiKLCAemBG4UuldUa:Tl3pcJbg/aCABnU+
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4