Analysis
-
max time kernel
8s -
max time network
5s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 01:01
Behavioral task
behavioral1
Sample
ROBLOXBEAMINGTOOL2.0byICE.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ROBLOXBEAMINGTOOL2.0byICE.exe
Resource
win10v2004-20240802-en
General
-
Target
ROBLOXBEAMINGTOOL2.0byICE.exe
-
Size
76.8MB
-
MD5
731d305cd17bb4702c378297593a5734
-
SHA1
f9b0cdf1d36981f96bc4eafd2d814eb47c73069b
-
SHA256
4fe2fe65f69d462cdfc5d2a539f16757a9dc54e6c72f9601e74be851d2895baf
-
SHA512
1f3a66cf93466a398e8eaf6cddcbae221e6551f9402d477b1edcf0e7b68faa76b0ec8b788834db37c1813e26dfc13975dd3b23d7a0b7e6f13b46f66f80f0c456
-
SSDEEP
1572864:VjEvHcRl0Sk8IpG7V+VPhqYdfME7FFlHFziYweyJulZUdgAdW4ljOux3a/Z9U:9EvHcR+SkB05awcfhdCpukdRxn49U
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ROBLOXBEAMINGTOOL2.0byICE.exepid process 2596 ROBLOXBEAMINGTOOL2.0byICE.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI27242\python312.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ROBLOXBEAMINGTOOL2.0byICE.exedescription pid process target process PID 2724 wrote to memory of 2596 2724 ROBLOXBEAMINGTOOL2.0byICE.exe ROBLOXBEAMINGTOOL2.0byICE.exe PID 2724 wrote to memory of 2596 2724 ROBLOXBEAMINGTOOL2.0byICE.exe ROBLOXBEAMINGTOOL2.0byICE.exe PID 2724 wrote to memory of 2596 2724 ROBLOXBEAMINGTOOL2.0byICE.exe ROBLOXBEAMINGTOOL2.0byICE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ROBLOXBEAMINGTOOL2.0byICE.exe"C:\Users\Admin\AppData\Local\Temp\ROBLOXBEAMINGTOOL2.0byICE.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\ROBLOXBEAMINGTOOL2.0byICE.exe"C:\Users\Admin\AppData\Local\Temp\ROBLOXBEAMINGTOOL2.0byICE.exe"2⤵
- Loads dropped DLL
PID:2596
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5506c760a20e6bb940590229d41449ffa
SHA1b7c439f253987fb0ff66fc5ce959cf711b18eb8d
SHA256e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5
SHA51234df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e