Resubmissions
08-07-2024 23:38
240708-3mqr1svdqn 1008-07-2024 23:37
240708-3l9thavdnm 1008-07-2024 23:16
240708-29be6swfqe 1008-07-2024 23:14
240708-27ygxstfrq 10Analysis
-
max time kernel
25s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 23:14
Behavioral task
behavioral1
Sample
RobloxTool2.45.exe
Resource
win7-20240705-en
General
-
Target
RobloxTool2.45.exe
-
Size
560KB
-
MD5
a6d0cce9aed3e8a5253320afe320a5cf
-
SHA1
80c69e820ed28392af4adc0c86ccbf6ed011a347
-
SHA256
adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5
-
SHA512
f6d21be9b58547c5f5396f7f14bac177090b2e00daaaef07424db9572d0efdc789cd80abfa6781a55e5fa26ee024b02b739c1a72090ee19e8fea5b7a85e66756
-
SSDEEP
12288:WLV6Btpmk25LG7Ilxs0G4ASfUsZblcfM1Zj7S:EApfayCW0XthbCM3S
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RobloxTool2.45.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Subsystem = "C:\\Program Files (x86)\\AGP Subsystem\\agpss.exe" RobloxTool2.45.exe -
Processes:
RobloxTool2.45.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxTool2.45.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RobloxTool2.45.exedescription ioc process File created C:\Program Files (x86)\AGP Subsystem\agpss.exe RobloxTool2.45.exe File opened for modification C:\Program Files (x86)\AGP Subsystem\agpss.exe RobloxTool2.45.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2716 schtasks.exe 2836 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
RobloxTool2.45.exepid process 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe 2304 RobloxTool2.45.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RobloxTool2.45.exepid process 2304 RobloxTool2.45.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RobloxTool2.45.exedescription pid process Token: SeDebugPrivilege 2304 RobloxTool2.45.exe Token: SeDebugPrivilege 2304 RobloxTool2.45.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
RobloxTool2.45.exedescription pid process target process PID 2304 wrote to memory of 2716 2304 RobloxTool2.45.exe schtasks.exe PID 2304 wrote to memory of 2716 2304 RobloxTool2.45.exe schtasks.exe PID 2304 wrote to memory of 2716 2304 RobloxTool2.45.exe schtasks.exe PID 2304 wrote to memory of 2716 2304 RobloxTool2.45.exe schtasks.exe PID 2304 wrote to memory of 2836 2304 RobloxTool2.45.exe schtasks.exe PID 2304 wrote to memory of 2836 2304 RobloxTool2.45.exe schtasks.exe PID 2304 wrote to memory of 2836 2304 RobloxTool2.45.exe schtasks.exe PID 2304 wrote to memory of 2836 2304 RobloxTool2.45.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEBA6.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEBA6.tmpFilesize
1KB
MD5d5ff21d38f0e1018fc72aa2f55f011aa
SHA15ad2c2e8143cd0e0f6d7dcef7391ab572e3cea37
SHA256bd4af90cd9750d3930b417bbb917fa3573d386dcb068e5a1fdca4ae88ee02382
SHA51243772bfed10631fc1ff65f85fa0d8afcd562da2bdf3178cb9cbc49aa2d6b075020900fd8f53af3f080330b8bad36b257a6a51ff6fb4ee20025a389a7c27610a2
-
C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmpFilesize
1KB
MD58aefdc623880016d77594b1802f74db6
SHA117608aaab6106247dec66a472516d023272c9b9b
SHA256ccd9d374a356e8635fe06015e07c986fb0e6f71099234ddc2935a6cb5e1571ac
SHA512bde73cc8244dcb054ff68b86df14ae644b0816aac8524e746e9bf0e68406c6d7e8ee6a0c642b11a9b197319b023c43fcbdc5eafe9c32e4011ad8065cea0b1eb5
-
memory/2304-0-0x0000000074111000-0x0000000074112000-memory.dmpFilesize
4KB
-
memory/2304-1-0x0000000074110000-0x00000000746BB000-memory.dmpFilesize
5.7MB
-
memory/2304-2-0x0000000074110000-0x00000000746BB000-memory.dmpFilesize
5.7MB
-
memory/2304-10-0x0000000074110000-0x00000000746BB000-memory.dmpFilesize
5.7MB