Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-10-2024 15:46

General

  • Target

    Pedro_Robux.exe

  • Size

    39.1MB

  • MD5

    6365ba95697f9fa8affdeb8fd116e14b

  • SHA1

    c6f09b62080c2df01cf2d79ee647f86a586b6f4b

  • SHA256

    83901384cee0c937e1955b81f69635caec5358d2267ab996fd12ad54f9d1e1f3

  • SHA512

    b493dc529256c04029117b43c05f9b9262615ecd3579dc3df3ba6cda0ac666d67ad45131a0a768407385bb0341f2d16da93cd74eedee8ae345c17f4ad887087f

  • SSDEEP

    786432:3x+yunjmpikrbcW9rp3AryPARxVZDhxMW23tdybpc:MGxbcehAryPARNDhxr23tdo

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pedro_Robux.exe
    "C:\Users\Admin\AppData\Local\Temp\Pedro_Robux.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Users\Admin\AppData\Local\Temp\onefile_2696_133728759937058000\Stub.exe
      C:\Users\Admin\AppData\Local\Temp\Pedro_Robux.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_2696_133728759937058000\python311.dll

    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.