General
-
Target
https://www.roblox.com/users/1171610343/profile
-
Sample
240821-wjgxdawdkn
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.roblox.com/users/1171610343/profile
Resource
win10-20240404-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___G247FX_.txt
cerber
http://p27dokhpz2n7nvgr.onion/B322-60C2-838A-0446-9291
http://p27dokhpz2n7nvgr.12hygy.top/B322-60C2-838A-0446-9291
http://p27dokhpz2n7nvgr.14ewqv.top/B322-60C2-838A-0446-9291
http://p27dokhpz2n7nvgr.14vvrc.top/B322-60C2-838A-0446-9291
http://p27dokhpz2n7nvgr.129p1t.top/B322-60C2-838A-0446-9291
http://p27dokhpz2n7nvgr.1apgrn.top/B322-60C2-838A-0446-9291
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___LW1LRJY_.hta
cerber
Targets
-
-
Target
https://www.roblox.com/users/1171610343/profile
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Contacts a large (1359) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Discovery
Network Service Discovery
2Query Registry
4System Information Discovery
5Browser Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Remote System Discovery
1