Analysis
-
max time kernel
56s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
19-07-2024 09:17
General
-
Target
Roblox Account Manager.exe
-
Size
5.5MB
-
MD5
eb54116db322c49ec2faca86f725931e
-
SHA1
c703685ac6221d7de624039d7351886b21ca53fc
-
SHA256
5c7d96455bbb045cb3cb3726d7b4fff2d0810a21d7fdb34ad134696aa7f47d5e
-
SHA512
ef6ea52df848bf8c7c77831ee5ca64cf337a92edbb0e8d0d38844e204157545aa3c397eeea12d05f276ce4984f519a1a05cf21bc04514fbb35beebf86d7f8e78
-
SSDEEP
98304:8H6+2bT1Qm7d9G3s2tIfKLUXk8zdywnr5a0kqXf0Fb7WnZhP+MQuPN5Ppauz+l:5Qm59siyLU0lY9a0kSIb7aZhP+MQuPNw
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 49 IoCs
-
Drops file in Windows directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 9 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp"C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{696A41C2-2D47-427C-8F50-EEBF30BF934B}\.cr\vcredist.tmp"C:\Windows\Temp\{696A41C2-2D47-427C-8F50-EEBF30BF934B}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=536 -burn.filehandle.self=544 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{A6575417-8B61-42D8-B7C0-A3B51F8A8C80}\.be\VC_redist.x86.exe"C:\Windows\Temp\{A6575417-8B61-42D8-B7C0-A3B51F8A8C80}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{18531EF6-751E-4188-A278-D6A9902F4BD9} {C96ED1B8-E462-4DCD-B63A-29E2DBB29296} 30605⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{ED487D9E-346E-472F-B643-D5E1CCD0FA03} {4B1299C8-57C0-456C-838B-938FCC1A0C26} 3166⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{ED487D9E-346E-472F-B643-D5E1CCD0FA03} {4B1299C8-57C0-456C-838B-938FCC1A0C26} 3167⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{ADD1081D-E7A1-4E9B-9F17-7E4A81D2F325} {213F9AEF-E9B2-4C8A-B723-ED81408D684A} 23448⤵
- Modifies registry class
-
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5d1a40943651874653c9bfe7b3170c382
SHA1016b0bb325f853104e762e337989d6859860df24
SHA2561076426ca8c4bf7ad914111f89a220c4dbb888ad0b0386eba5dc18174b1b452e
SHA512a3bf981752aa90c5d4745b0e2afeb4cd9a706cc955ab25a663dc92fbd4fad7af4d11a8904f1dba0b89f4ee358da38535d9c083fcdbb26bd994d6d1c3f17c688a
-
Filesize
18KB
MD57d5601a85f19d550ccd67f926b0673f0
SHA16e59c00e976309bd278adf7b2e30864c3152ade6
SHA256eebc9ab9d24e8e5c1f176831a3704fc9b16fe1d68329f58c21cf163b7b319e51
SHA51201eb7d31b15d36f0ba8c70fd906ba67d1995ae0239d4670eb34bfc4d0af8eb427bb2ffa68620f9ed1e1cf63cd3fdf79929e32c5b35a9aa5f3bb0fab331eaeb64
-
Filesize
20KB
MD591e585f8432e4ab21340a8de4bf1f169
SHA12a61c58c57f7cf3f911621d9d59e4447c0a869e9
SHA256a9889e6f0cac2ab34d886283227cf3c821eebf930e9ab1e833611c5bfa7a0693
SHA5128ebc7f36742f906823e790ad3520081635c4914173c211755897526333b69a6f28ee6299bd0f46ac7757513dc7111d2fa2ffda495f48a6d4449280c3737cbd12
-
Filesize
19KB
MD54f5eb7182bf4dcc11d3af9516b9a5ac1
SHA18654dffd2cc9b367e747219acb54e181249a2e85
SHA256cb35bcf1863ff8626d89cf2fda70dce137677afb8667886ef7ce903b2527479e
SHA51222be7803e5678e4a236d056ce54aeb3134645081a660445e95eb10c3783e7e62215c8fe33db55438a35c0e7f376c3c928fdb350eb4d90980b49743a7dd6c99ff
-
Filesize
1KB
MD5a02e8a8a790f0e0861e3b6b0dbe56062
SHA1a3e65805e5c78641cafebc1052906d7350da9d2e
SHA2567fada0f81b63e1ecb265e9620ace8f5f0d40773626081849f5d98e668bc4e594
SHA512108a81f818aa027834d621c771e427ee3f300c59d9dc10d853b94b1e8d635cf6bc06338dce31da30b08660c6fb06a39f9069c983bb585049f5fe9f50b753eb42
-
Filesize
314B
MD5f18fa783f4d27e35e54e54417334bfb4
SHA194511cdf37213bebdaf42a6140c9fe5be8eb07ba
SHA256563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
SHA512602f6a68562bc89a4b3c3a71c2477377f161470bf8ae8e6925bf35691367115abfa9809925bd09c35596c6a3e5a7e9d090e5198e6a885a6658049c8732a05071
-
Filesize
6KB
MD5d5e4966de947333592289d70916257a9
SHA15907df0fd07df6c33926906e94f4ed08d40be017
SHA256d726d47b772a70fabc777c8ed46655fe5200e672f01f11dd95c5f4994e0a71e0
SHA512c618054766bee664f0605a037f065c196c35495ee993b305f0bece4738ec9f7bd632dc8fb541bcf9d156f12e115455f31dd8db2a8cceb9d7d2f0d05d501831e9
-
Filesize
2KB
MD52c21fb94e7e67518328568f0905e3035
SHA119740f6f4de1cdf7a04eed09a90422972dc8f4fb
SHA2560dbcb6d6c5a56a5737c9a2b6a600a0a584c0fc65b1d17a3150e3cda8e23d1884
SHA512363b64ebed04360a09569fbb229b88a41f068533c66dfab4155d761c470bc1cf46766b1cc5c2452647f2922aeaa87e8ae16d4d4d4035a5181662326edf59b93a
-
Filesize
2KB
MD5c1cc021782dd3f9414937cd72ee1641f
SHA1f153181cae689eb654cdcc04c0b0c73883ebf27d
SHA256e55c687ee47b42f9e6fb83a31ac73f0269963164b321adbaca6fe4f6be076d94
SHA512bf1a02537b9280b640038a00dcdd771be7519bd813087de43677ae0ce39e8edc0647a9e1b7ba752ab9ad9ea5ca3e6b24d9841b080da87bd2ef411e94c31281f0
-
Filesize
936B
MD5e4659ac08af3582a23f38bf6c562f841
SHA119cb4f014ba96285fa1798f008deabce632c7e76
SHA256e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
SHA5125bfa1e021cc7ee5e7a00da865d68684202b3b92d3d369b85b80c591fffa67725d434398325dc1e37c659eab62c0a4118b3e279ac0096b95790d252ceb6254249
-
Filesize
13.2MB
MD58457542fd4be74cb2c3a92b3386ae8e9
SHA1198722b4f5fc62721910569d9d926dce22730c22
SHA256a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
SHA51291a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182
-
Filesize
634KB
MD5337b547d2771fdad56de13ac94e6b528
SHA13aeecc5933e7d8977e7a3623e8e44d4c3d0b4286
SHA25681873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
SHA5120d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
822KB
MD525bd21af44d3968a692e9b8a85f5c11d
SHA1d805d1624553199529a82151f23a1330ac596888
SHA256f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809
SHA512ed3660183bf4e0d39e4f43a643007afc143b1d4ec0b45f0fdce28d8e896f646ec24a2a7a5429e8b10f4379cb4ffd1572adba10fc426990d05c0cafefdd87a4fb
-
Filesize
4.9MB
MD53a7979fbe74502ddc0a9087ee9ca0bdf
SHA13c63238363807c2f254163769d0a582528e115af
SHA2567327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca
SHA5126435db0f210ad317f4cd00bb3300eb41fb86649f7a0e3a05e0f64f8d0163ab53dbdb3c98f99a15102ce09fcd437a148347bab7bfd4afe4c90ff2ea05bb4febff
-
Filesize
180KB
MD52ba51e907b5ee6b2aef6dfe5914ae3e3
SHA16cc2c49734bf9965fe0f3977705a417ed8548718
SHA256be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a
SHA512e3ba5aa8f366e3b1a92d8258daa74f327248fb21f168b7472b035f8d38f549f5f556eb9093eb8483ca51b78e9a77ee6e5b6e52378381cce50918d81e8e982d47
-
Filesize
180KB
MD5828f217e9513cfff708ffe62d238cfc5
SHA19fb65d4edb892bf940399d5fd6ae3a4b15c2e4ba
SHA256a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886
SHA512ffc72b92f1431bbd07889e28b55d14ea11f8401e2d0b180e43a898914209893941affacc0a4ea34eeefc9b0ca4bc84a3045591cd98aae6bdb11ae831dc6bb121
-
Filesize
476KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
152KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
5.5MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
856KB
-
Filesize
136KB
-
Filesize
712KB
-
Filesize
352KB
-
Filesize
40KB
-
Filesize
640KB
-
Filesize
7.7MB
-
Filesize
208KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
464KB
-
Filesize
7.7MB
