f9b46c5b76da6de70ce500a3d03fc395da2c36b1fe3a1bc37ad6588626f00514

Analysis

max time kernel
90s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
02/06/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

RBXFlox.exe
Size

364KB
MD5

35db26be771dc5ed21916b41f120b96f
SHA1

9d26bc0a849efde1912f4b78dfd2a94fdd1ee741
SHA256

f9b46c5b76da6de70ce500a3d03fc395da2c36b1fe3a1bc37ad6588626f00514
SHA512

7f047af462539dceea48ec775c12565e0bbf101b279f42a81b8847f096d8ff6823396065a3296c9bbe9eb560408d24c413ead121df97a3fe23d9e4ac379e634f
SSDEEP

6144:fgZiAEAO0sByNsAal3gVAWgS7/OhwjjN2eawlb8NwC:fgZXEAO/BUdG3gVdt7Ky0eawd8NwC

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3552	netsh.exe
3428	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\050e77055b5594c9d6229033038c9670.exe	conhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\050e77055b5594c9d6229033038c9670.exe	conhost.exe

Executes dropped EXE 2 IoCs

pid	Process
3616	svchost.exe
4032	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\050e77055b5594c9d6229033038c9670 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\050e77055b5594c9d6229033038c9670 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1608	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe
4032	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4032	conhost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	conhost.exe
Token: 33	4032	conhost.exe
Token: SeIncBasePriorityPrivilege	4032	conhost.exe
Token: 33	4032	conhost.exe
Token: SeIncBasePriorityPrivilege	4032	conhost.exe
Token: 33	4032	conhost.exe
Token: SeIncBasePriorityPrivilege	4032	conhost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3616	2480	RBXFlox.exe	81
PID 2480 wrote to memory of 3616	2480	RBXFlox.exe	81
PID 2480 wrote to memory of 3616	2480	RBXFlox.exe	81
PID 3616 wrote to memory of 4032	3616	svchost.exe	84
PID 3616 wrote to memory of 4032	3616	svchost.exe	84
PID 3616 wrote to memory of 4032	3616	svchost.exe	84
PID 4032 wrote to memory of 3552	4032	conhost.exe	85
PID 4032 wrote to memory of 3552	4032	conhost.exe	85
PID 4032 wrote to memory of 3552	4032	conhost.exe	85
PID 4032 wrote to memory of 3428	4032	conhost.exe	88
PID 4032 wrote to memory of 3428	4032	conhost.exe	88
PID 4032 wrote to memory of 3428	4032	conhost.exe	88
PID 4032 wrote to memory of 3176	4032	conhost.exe	89
PID 4032 wrote to memory of 3176	4032	conhost.exe	89
PID 4032 wrote to memory of 3176	4032	conhost.exe	89
PID 3176 wrote to memory of 1608	3176	cmd.exe	92
PID 3176 wrote to memory of 1608	3176	cmd.exe	92
PID 3176 wrote to memory of 1608	3176	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\RBXFlox.exe
"C:\Users\Admin\AppData\Local\Temp\RBXFlox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Users\Admin\AppData\Roaming\conhost.exe
    "C:\Users\Admin\AppData\Roaming\conhost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:3552
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe"
      4⤵
      Modifies Windows Firewall
      PID:3428
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /k ping 0 & del "C:\Users\Admin\AppData\Roaming\conhost.exe" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 0
        5⤵
        Runs ping.exe
        
        PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe

Filesize
37KB

MD5
ba5483d6cca80b233354a7a32e75ec29

SHA1
7d43d0ffaf39eb2e49f515cbb976fb0b374e9501

SHA256
b85fdd5fad362079988a81ae2db8587da09d6c5e16d9c26094fb009392a56673

SHA512
3c990a6d2315b5f59cd8a06b9d4171b7631e197a84af9608f32b7e8e516cb8a99d0041c159ab9bcb3b556f12f32626b2f06c198ca6b7312d86d79fb1143e5a75

Download Submit
memory/3616-9-0x0000000072B91000-0x0000000072B92000-memory.dmp

Filesize
4KB

Download
memory/3616-10-0x0000000072B90000-0x0000000073141000-memory.dmp

Filesize
5.7MB

Download
memory/3616-20-0x0000000072B90000-0x0000000073141000-memory.dmp

Filesize
5.7MB

Download
memory/4032-21-0x0000000072B90000-0x0000000073141000-memory.dmp

Filesize
5.7MB

Download
memory/4032-22-0x0000000072B90000-0x0000000073141000-memory.dmp

Filesize
5.7MB

Download
memory/4032-24-0x0000000072B90000-0x0000000073141000-memory.dmp

Filesize
5.7MB

Download
memory/4032-28-0x0000000072B90000-0x0000000073141000-memory.dmp

Filesize
5.7MB

Download