Analysis
-
max time kernel
93s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 20:24
Behavioral task
behavioral1
Sample
roblox_fastwalk.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
roblox_fastwalk.exe
Resource
win11-20240508-en
General
-
Target
roblox_fastwalk.exe
-
Size
5.0MB
-
MD5
de17189e84c44c1897bf208d1b2870eb
-
SHA1
fece910b6956a71b9402419151a3e45584ace801
-
SHA256
8a501c4549350715eaf14d96f24b6a919324730ce0d778c8cecd93c003a2f7df
-
SHA512
07adb1a9648da504b62deb6d554af523abcf52ff442bb9f9011f56eac5c8d2078d619315a6f428f4f6212e892a17c7432ed4a9746e88b79b7044a047ba91a98a
-
SSDEEP
98304:6q873WHaJVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAxNeyN/qqtxluoDmEx:6q9H8uWJysVYvsOaoyMxxvjDDAxESlu
Malware Config
Signatures
-
Loads dropped DLL 10 IoCs
Processes:
roblox_fastwalk.exepid process 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe 4668 roblox_fastwalk.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
roblox_fastwalk.exedescription pid process target process PID 1420 wrote to memory of 4668 1420 roblox_fastwalk.exe roblox_fastwalk.exe PID 1420 wrote to memory of 4668 1420 roblox_fastwalk.exe roblox_fastwalk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\roblox_fastwalk.exe"C:\Users\Admin\AppData\Local\Temp\roblox_fastwalk.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\roblox_fastwalk.exe"C:\Users\Admin\AppData\Local\Temp\roblox_fastwalk.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\VCRUNTIME140.dllFilesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\_bz2.pydFilesize
82KB
MD53dc8af67e6ee06af9eec52fe985a7633
SHA11451b8c598348a0c0e50afc0ec91513c46fe3af6
SHA256c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929
SHA512da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\_ctypes.pydFilesize
120KB
MD5f1e33a8f6f91c2ed93dc5049dd50d7b8
SHA123c583dc98aa3f6b8b108db5d90e65d3dd72e9b4
SHA2569459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
SHA512229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\_hashlib.pydFilesize
44KB
MD5a6448bc5e5da21a222de164823add45c
SHA16c26eb949d7eb97d19e42559b2e3713d7629f2f9
SHA2563692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
SHA512a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\_lzma.pydFilesize
246KB
MD537057c92f50391d0751f2c1d7ad25b02
SHA1a43c6835b11621663fa251da421be58d143d2afb
SHA2569442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764
SHA512953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\_queue.pydFilesize
27KB
MD544b72e0ad8d1e1ec3d8722088b48c3c5
SHA1e0f41bf85978dd8f5abb0112c26322b72c0d7770
SHA2564aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e
SHA51205853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\_socket.pydFilesize
77KB
MD5d6bae4b430f349ab42553dc738699f0e
SHA17e5efc958e189c117eccef39ec16ebf00e7645a9
SHA256587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef
SHA512a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\base_library.zipFilesize
821KB
MD520a26d2dd017e2942ea4e0b9b599771d
SHA1ce920c1925466c5a681ebd0b0a08ec4b50147ebe
SHA256cdb4a97fe6eea8bbd4997b490c393acd4834d00fcd1fe79aefa9733e496cd9af
SHA512076f161bd903bc8895b8d1182c3ebe3c8d16afbe7b2c19594d7c4cbff80dba348721eea8c17881f326ed28f8b191f598b5e5657bf0d99664c57cb3e8f6180241
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\libcrypto-1_1.dllFilesize
3.2MB
MD5bf83f8ad60cb9db462ce62c73208a30d
SHA1f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\libffi-7.dllFilesize
32KB
MD54424baf6ed5340df85482fa82b857b03
SHA1181b641bf21c810a486f855864cd4b8967c24c44
SHA2568c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
SHA5128adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\python38.dllFilesize
4.0MB
MD5d2a8a5e7380d5f4716016777818a32c5
SHA1fb12f31d1d0758fe3e056875461186056121ed0c
SHA25659ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\select.pydFilesize
26KB
MD56ae54d103866aad6f58e119d27552131
SHA1bc53a92a7667fd922ce29e98dfcf5f08f798a3d2
SHA25663b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
SHA512ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0
-
C:\Users\Admin\AppData\Local\Temp\_MEI14202\unicodedata.pydFilesize
1.0MB
MD54c0d43f1a31e76255cb592bb616683e7
SHA10a9f3d77a6e064baebacacc780701117f09169ad
SHA2560f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
SHA512b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778