Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2024 06:45
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
RobloxPlayerLauncher.exe
Resource
win10v2004-20241007-en
General
-
Target
RobloxPlayerLauncher.exe
-
Size
9.9MB
-
MD5
e44b0115b09a99e810c9e553e6a3b738
-
SHA1
e32ea33b3528a130f65d51cf60521aa3a4fdd2d2
-
SHA256
25193a2af45b78c79136888748092d592a152f73c4805797f2d126b49d0fca8e
-
SHA512
33580afabdd2c770514711384a09feab815715a2c417574afc00eb2bf60dc3991082e5ceb8148ae8a995896d1e3710b0b1ca0d3f450c86a481afed7896aba834
-
SSDEEP
98304:FzU4brhxBASgf/gEpiji6Ig8TWAtEIICafZm/mbnXg:FxrhxBAGZji6IdTh+RTXg
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1297050065504047176/JtiObjk6yoWN5vIB4pnq2_TS1V3sF6nkfTv-FZCExVxzGYgKn6iFvuGtYs2QnO8K_8pk
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" RobloxPlayerLauncher.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org 7 ip-api.com -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 8 Go-http-client/1.1 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 RobloxPlayerLauncher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 RobloxPlayerLauncher.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 760 RobloxPlayerLauncher.exe Token: SeIncreaseQuotaPrivilege 464 wmic.exe Token: SeSecurityPrivilege 464 wmic.exe Token: SeTakeOwnershipPrivilege 464 wmic.exe Token: SeLoadDriverPrivilege 464 wmic.exe Token: SeSystemProfilePrivilege 464 wmic.exe Token: SeSystemtimePrivilege 464 wmic.exe Token: SeProfSingleProcessPrivilege 464 wmic.exe Token: SeIncBasePriorityPrivilege 464 wmic.exe Token: SeCreatePagefilePrivilege 464 wmic.exe Token: SeBackupPrivilege 464 wmic.exe Token: SeRestorePrivilege 464 wmic.exe Token: SeShutdownPrivilege 464 wmic.exe Token: SeDebugPrivilege 464 wmic.exe Token: SeSystemEnvironmentPrivilege 464 wmic.exe Token: SeRemoteShutdownPrivilege 464 wmic.exe Token: SeUndockPrivilege 464 wmic.exe Token: SeManageVolumePrivilege 464 wmic.exe Token: 33 464 wmic.exe Token: 34 464 wmic.exe Token: 35 464 wmic.exe Token: 36 464 wmic.exe Token: SeIncreaseQuotaPrivilege 464 wmic.exe Token: SeSecurityPrivilege 464 wmic.exe Token: SeTakeOwnershipPrivilege 464 wmic.exe Token: SeLoadDriverPrivilege 464 wmic.exe Token: SeSystemProfilePrivilege 464 wmic.exe Token: SeSystemtimePrivilege 464 wmic.exe Token: SeProfSingleProcessPrivilege 464 wmic.exe Token: SeIncBasePriorityPrivilege 464 wmic.exe Token: SeCreatePagefilePrivilege 464 wmic.exe Token: SeBackupPrivilege 464 wmic.exe Token: SeRestorePrivilege 464 wmic.exe Token: SeShutdownPrivilege 464 wmic.exe Token: SeDebugPrivilege 464 wmic.exe Token: SeSystemEnvironmentPrivilege 464 wmic.exe Token: SeRemoteShutdownPrivilege 464 wmic.exe Token: SeUndockPrivilege 464 wmic.exe Token: SeManageVolumePrivilege 464 wmic.exe Token: 33 464 wmic.exe Token: 34 464 wmic.exe Token: 35 464 wmic.exe Token: 36 464 wmic.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 760 wrote to memory of 2360 760 RobloxPlayerLauncher.exe 85 PID 760 wrote to memory of 2360 760 RobloxPlayerLauncher.exe 85 PID 760 wrote to memory of 4132 760 RobloxPlayerLauncher.exe 86 PID 760 wrote to memory of 4132 760 RobloxPlayerLauncher.exe 86 PID 760 wrote to memory of 464 760 RobloxPlayerLauncher.exe 88 PID 760 wrote to memory of 464 760 RobloxPlayerLauncher.exe 88 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2360 attrib.exe 4132 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe2⤵
- Views/modifies file attributes
PID:2360
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:4132
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.9MB
MD5e44b0115b09a99e810c9e553e6a3b738
SHA1e32ea33b3528a130f65d51cf60521aa3a4fdd2d2
SHA25625193a2af45b78c79136888748092d592a152f73c4805797f2d126b49d0fca8e
SHA51233580afabdd2c770514711384a09feab815715a2c417574afc00eb2bf60dc3991082e5ceb8148ae8a995896d1e3710b0b1ca0d3f450c86a481afed7896aba834