Analysis
-
max time kernel
89s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/11/2024, 10:41
General
-
Target
roblox executor.exe
-
Size
61KB
-
MD5
68adc600ea667eb3f961aae6a255185d
-
SHA1
1ac679eddab6dad6b96bc52e5ef63f510db2453e
-
SHA256
deae8a2730c0fdf4cb2b2805621e48902c05647fc3882fc4a04d346b0a04ed93
-
SHA512
337baf180e6779ec0c3ae01f89139629ec123e1963c61da063d3f019c2507de631a5416312d5978f74ce1c57d2c3ce8f528accea6f3b0deaaef569d23b1d54df
-
SSDEEP
1536:WpK5NoIGud+hxXIvMf/dYUDbFqBjSBLYOebCK:W1/uchBPKUDbFT8OebT
Malware Config
Extracted
Family
xworm
C2
thus-dh.gl.at.ply.gg:40949
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2168-1-0x0000000000BA0000-0x0000000000BB6000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2628 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2168 roblox executor.exe Token: SeDebugPrivilege 2628 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe 2628 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\roblox executor.exe"C:\Users\Admin\AppData\Local\Temp\roblox executor.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2628