Resubmissions
08-07-2024 23:38
240708-3mqr1svdqn 1008-07-2024 23:37
240708-3l9thavdnm 1008-07-2024 23:16
240708-29be6swfqe 1008-07-2024 23:14
240708-27ygxstfrq 10Analysis
-
max time kernel
2s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 23:16
Behavioral task
behavioral1
Sample
RobloxTool2.45.exe
Resource
win7-20240704-en
General
-
Target
RobloxTool2.45.exe
-
Size
560KB
-
MD5
a6d0cce9aed3e8a5253320afe320a5cf
-
SHA1
80c69e820ed28392af4adc0c86ccbf6ed011a347
-
SHA256
adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5
-
SHA512
f6d21be9b58547c5f5396f7f14bac177090b2e00daaaef07424db9572d0efdc789cd80abfa6781a55e5fa26ee024b02b739c1a72090ee19e8fea5b7a85e66756
-
SSDEEP
12288:WLV6Btpmk25LG7Ilxs0G4ASfUsZblcfM1Zj7S:EApfayCW0XthbCM3S
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RobloxTool2.45.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PCI Service = "C:\\Program Files (x86)\\PCI Service\\pcisvc.exe" RobloxTool2.45.exe -
Processes:
RobloxTool2.45.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxTool2.45.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RobloxTool2.45.exedescription ioc process File created C:\Program Files (x86)\PCI Service\pcisvc.exe RobloxTool2.45.exe File opened for modification C:\Program Files (x86)\PCI Service\pcisvc.exe RobloxTool2.45.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2828 schtasks.exe 2708 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
RobloxTool2.45.exepid process 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe 2400 RobloxTool2.45.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RobloxTool2.45.exedescription pid process Token: SeDebugPrivilege 2400 RobloxTool2.45.exe Token: SeDebugPrivilege 2400 RobloxTool2.45.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
RobloxTool2.45.exedescription pid process target process PID 2400 wrote to memory of 2828 2400 RobloxTool2.45.exe schtasks.exe PID 2400 wrote to memory of 2828 2400 RobloxTool2.45.exe schtasks.exe PID 2400 wrote to memory of 2828 2400 RobloxTool2.45.exe schtasks.exe PID 2400 wrote to memory of 2828 2400 RobloxTool2.45.exe schtasks.exe PID 2400 wrote to memory of 2708 2400 RobloxTool2.45.exe schtasks.exe PID 2400 wrote to memory of 2708 2400 RobloxTool2.45.exe schtasks.exe PID 2400 wrote to memory of 2708 2400 RobloxTool2.45.exe schtasks.exe PID 2400 wrote to memory of 2708 2400 RobloxTool2.45.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEA9D.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEB3A.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEA9D.tmpFilesize
1KB
MD5d5ff21d38f0e1018fc72aa2f55f011aa
SHA15ad2c2e8143cd0e0f6d7dcef7391ab572e3cea37
SHA256bd4af90cd9750d3930b417bbb917fa3573d386dcb068e5a1fdca4ae88ee02382
SHA51243772bfed10631fc1ff65f85fa0d8afcd562da2bdf3178cb9cbc49aa2d6b075020900fd8f53af3f080330b8bad36b257a6a51ff6fb4ee20025a389a7c27610a2
-
C:\Users\Admin\AppData\Local\Temp\tmpEB3A.tmpFilesize
1KB
MD5a4f6fa4537e2dcf0d3e2802c0f070a4d
SHA103545095bfeddd7656b5b8547ab84a810324a94f
SHA256192ac26e1895b267149bde35c55327f4a441693495239da5899062924d45bd11
SHA512a4293123d718b0511a8301a7f536e403cecf8bc89f25f9dc4692b293eb8a554a8eb67993a26fe0e96792b6eb3573b34e9b270777cafe95c2383268da6d40fd2e
-
memory/2400-0-0x0000000074D51000-0x0000000074D52000-memory.dmpFilesize
4KB
-
memory/2400-1-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2400-2-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB