Analysis
-
max time kernel
145s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-08-2024 09:09
Behavioral task
behavioral1
Sample
Robux.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
General
-
Target
Robux.exe
-
Size
45KB
-
MD5
19a2f0fcb384b31f246fab43cb8446d7
-
SHA1
95fd873a00c547b4720456f280e9024d1b4980e2
-
SHA256
8d0d2a0c6e54610058b903b773d0f5e0f8e294312b3b02737223db0c8f599344
-
SHA512
af719eeb5b9c078c23e90cb5c7ad3eefd33efa4d13da491659c63bd712a8ac5bb5b2bddffd535821817066112b772d9bdecc5d53377deec8052bd4483a2c54b9
-
SSDEEP
768:Cu/dRTUo0HQbWUnmjSmo2qMueeXKSocbbbQtN8/nPI6kzjbGgX3ir/pwIZBDZ2x:Cu/dRTUPE27eH2tNKA6k3bZXSrHd2x
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
gY12qkvJtnRz
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Robux.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2072 Robux.exe