Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 18:46
Behavioral task
behavioral1
Sample
Robux Hacker.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Robux Hacker.exe
Resource
win10v2004-20240508-en
General
-
Target
Robux Hacker.exe
-
Size
80.1MB
-
MD5
14876666726ce716b152749698065aac
-
SHA1
f024f37bef3cc8ddb49a181003fef0ca0715f589
-
SHA256
e6d322c93c410af0529d346d4cea10fcc0d4871fc03f71d2362773576c3daa37
-
SHA512
54e577f2f7119ba95487ad99aed157f50c4e5b232f41d9aa0ff5b71994e1f12c0721539cf734909d4d73075eb1f881991f7e45187b89759438f150432bf9f152
-
SSDEEP
1572864:9vNBYQ3j0C3Sk8IpG7V+VPhqcPE70jCDPRQvljSvOul/JGZGHkVZWR9/HtsBqA:9vNBY+NSkB05awcVuD2wOuNzSo9/Mq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Robux Hacker.exepid process 2840 Robux Hacker.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI13402\python311.dll upx behavioral1/memory/2840-1263-0x000007FEF6580000-0x000007FEF6B69000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Robux Hacker.exedescription pid process target process PID 1340 wrote to memory of 2840 1340 Robux Hacker.exe Robux Hacker.exe PID 1340 wrote to memory of 2840 1340 Robux Hacker.exe Robux Hacker.exe PID 1340 wrote to memory of 2840 1340 Robux Hacker.exe Robux Hacker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Robux Hacker.exe"C:\Users\Admin\AppData\Local\Temp\Robux Hacker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Robux Hacker.exe"C:\Users\Admin\AppData\Local\Temp\Robux Hacker.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI13402\python311.dllFilesize
1.6MB
MD5546cc5fe76abc35fdbf92f682124e23d
SHA15c1030752d32aa067b49125194befee7b3ee985a
SHA25643bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76
SHA512cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720
-
memory/2840-1263-0x000007FEF6580000-0x000007FEF6B69000-memory.dmpFilesize
5.9MB