Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02-08-2024 19:48
Behavioral task
behavioral1
Sample
RobloxWaveInjector.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
RobloxWaveInjector.exe
Resource
win10v2004-20240802-en
General
-
Target
RobloxWaveInjector.exe
-
Size
106.9MB
-
MD5
876e9e248a8c2f0fbd81bbf4368910ca
-
SHA1
2d96ef880dd0ddf72893586dda055ab72e923439
-
SHA256
3f4bb48158c276ee34506a30e6eca587a67aa3d8706bdefc14c865cbbef849d3
-
SHA512
b4a3a578feb74353e2b03230c7192942f9a9e6faeb57650d4e0005399bf00ee2b043569c632aec62143820f389c48386be53fd0d114ebc687147817746a42611
-
SSDEEP
3145728:gPbiS6xjKcBa6R2qHO5izBVnG0iWMstB2Ox0Uu3:I2SWNa6HHCittieBm
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
RobloxWaveInjector.exepid process 2032 RobloxWaveInjector.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
RobloxWaveInjector.exedescription pid process target process PID 1940 wrote to memory of 2032 1940 RobloxWaveInjector.exe RobloxWaveInjector.exe PID 1940 wrote to memory of 2032 1940 RobloxWaveInjector.exe RobloxWaveInjector.exe PID 1940 wrote to memory of 2032 1940 RobloxWaveInjector.exe RobloxWaveInjector.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxWaveInjector.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWaveInjector.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\RobloxWaveInjector.exe"C:\Users\Admin\AppData\Local\Temp\RobloxWaveInjector.exe"2⤵
- Loads dropped DLL
PID:2032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5387bb2c1e40bde1517f06b46313766be
SHA1601f83ef61c7699652dec17edd5a45d6c20786c4
SHA2560817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
SHA512521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad