9bc59a8b5fc607235c0ac6ddea001f0f2ddea452cfae001dc1e806cfd89e13e9

Analysis

max time kernel
88s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-08-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox Account Manager/x86/chrome_elf.dll
Size

1.1MB
MD5

03c4909d49ffdb2b2b812e1706826c0e
SHA1

5bed7e593fc227cf96df19877d05d43f9558f34d
SHA256

9d8419d49bfc2cdec6dcee3a4b057401698354f960f265e8c96a63f4d3eaab7b
SHA512

6a63ce82e84153462abbafe5461c22b575de5c4443554be01f067f0ba54da5fa23b23e36e1e3b955e578c44456b2c6e48dbcbba55a3299aa7ee5e822a9c4e4a7
SSDEEP

24576:sqgLNuKxE4V5g57ZEw7+J2ZhrJpjZ891:UwKX5g9ZEw7QeFBu1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4496	1104	rundll32.exe	82
PID 1104 wrote to memory of 4496	1104	rundll32.exe	82
PID 1104 wrote to memory of 4496	1104	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager\x86\chrome_elf.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager\x86\chrome_elf.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads