Resubmissions
08-07-2024 23:38
240708-3mqr1svdqn 1008-07-2024 23:37
240708-3l9thavdnm 1008-07-2024 23:16
240708-29be6swfqe 1008-07-2024 23:14
240708-27ygxstfrq 10Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-07-2024 23:38
General
-
Target
RobloxTool2.45.exe
-
Size
560KB
-
MD5
a6d0cce9aed3e8a5253320afe320a5cf
-
SHA1
80c69e820ed28392af4adc0c86ccbf6ed011a347
-
SHA256
adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5
-
SHA512
f6d21be9b58547c5f5396f7f14bac177090b2e00daaaef07424db9572d0efdc789cd80abfa6781a55e5fa26ee024b02b739c1a72090ee19e8fea5b7a85e66756
-
SSDEEP
12288:WLV6Btpmk25LG7Ilxs0G4ASfUsZblcfM1Zj7S:EApfayCW0XthbCM3S
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RobloxTool2.45.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Service = "C:\\Program Files (x86)\\ARP Service\\arpsvc.exe" RobloxTool2.45.exe -
Processes:
RobloxTool2.45.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxTool2.45.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RobloxTool2.45.exedescription ioc process File created C:\Program Files (x86)\ARP Service\arpsvc.exe RobloxTool2.45.exe File opened for modification C:\Program Files (x86)\ARP Service\arpsvc.exe RobloxTool2.45.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4260 schtasks.exe 1812 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
RobloxTool2.45.exepid process 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe 3348 RobloxTool2.45.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RobloxTool2.45.exepid process 3348 RobloxTool2.45.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RobloxTool2.45.exedescription pid process Token: SeDebugPrivilege 3348 RobloxTool2.45.exe Token: SeDebugPrivilege 3348 RobloxTool2.45.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
RobloxTool2.45.exedescription pid process target process PID 3348 wrote to memory of 1812 3348 RobloxTool2.45.exe schtasks.exe PID 3348 wrote to memory of 1812 3348 RobloxTool2.45.exe schtasks.exe PID 3348 wrote to memory of 1812 3348 RobloxTool2.45.exe schtasks.exe PID 3348 wrote to memory of 4260 3348 RobloxTool2.45.exe schtasks.exe PID 3348 wrote to memory of 4260 3348 RobloxTool2.45.exe schtasks.exe PID 3348 wrote to memory of 4260 3348 RobloxTool2.45.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"C:\Users\Admin\AppData\Local\Temp\RobloxTool2.45.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA49C.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA4FB.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA49C.tmpFilesize
1KB
MD5d5ff21d38f0e1018fc72aa2f55f011aa
SHA15ad2c2e8143cd0e0f6d7dcef7391ab572e3cea37
SHA256bd4af90cd9750d3930b417bbb917fa3573d386dcb068e5a1fdca4ae88ee02382
SHA51243772bfed10631fc1ff65f85fa0d8afcd562da2bdf3178cb9cbc49aa2d6b075020900fd8f53af3f080330b8bad36b257a6a51ff6fb4ee20025a389a7c27610a2
-
C:\Users\Admin\AppData\Local\Temp\tmpA4FB.tmpFilesize
1KB
MD51badb6e2b29a1c4bfff3c179d53ab96b
SHA14b2ad3e5f3826d252d1c8bf1c8f0702f39129fa1
SHA2566259ac4e6859a1b528d77ccea12b378f7dfa1eff359d9b8899414b4b1c484699
SHA51236338e2a74fd85c5f2c84be009981a7260692c1bcb121a42018209031082da69bf65640702d53e28b54871f9d44e65fdbebaf4771c530699c3e93981b58129b4
-
memory/3348-0-0x0000000074CB1000-0x0000000074CB2000-memory.dmpFilesize
4KB
-
memory/3348-1-0x0000000074CB0000-0x0000000075261000-memory.dmpFilesize
5.7MB
-
memory/3348-2-0x0000000074CB0000-0x0000000075261000-memory.dmpFilesize
5.7MB
-
memory/3348-10-0x0000000074CB0000-0x0000000075261000-memory.dmpFilesize
5.7MB
-
memory/3348-11-0x0000000074CB0000-0x0000000075261000-memory.dmpFilesize
5.7MB
-
memory/3348-12-0x0000000074CB0000-0x0000000075261000-memory.dmpFilesize
5.7MB