lumma | hxxps://www[.]mediafire[.]com/folder/0s4l0ql101w6f/ROBLOX+EXECUTOR

Resubmissions

29/12/2024, 22:41

241229-2mj4ssyral 10

29/12/2024, 22:39

241229-2k9xfayqel 10

Analysis

max time kernel
61s
max time network
62s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29/12/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/0s4l0ql101w6f/ROBLOX+EXECUTOR

Score

10^/10

lumma discovery phishing stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://ingreem-eilish.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 4 IoCs

pid	Process
4928	Loader V2.exe
3288	Loader.exe
3532	Loader.exe
4176	Loader V2.exe

Loads dropped DLL 4 IoCs

pid	Process
4928	Loader V2.exe
3288	Loader.exe
3532	Loader.exe
4176	Loader V2.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4928 set thread context of 3200	4928	Loader V2.exe	105
PID 3288 set thread context of 4152	3288	Loader.exe	111
PID 3532 set thread context of 4720	3532	Loader.exe	114
PID 4176 set thread context of 1004	4176	Loader V2.exe	117

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2504	4928	WerFault.exe	101
436	4176	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader V2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader V2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Roblox Executor V2.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
3676	msedge.exe
3676	msedge.exe
3856	identity_helper.exe
3856	identity_helper.exe
2288	msedge.exe
2288	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1152	7zG.exe
Token: 35	1152	7zG.exe
Token: SeSecurityPrivilege	1152	7zG.exe
Token: SeSecurityPrivilege	1152	7zG.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
1152	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 2620	3676	msedge.exe	77
PID 3676 wrote to memory of 2620	3676	msedge.exe	77
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 4116	3676	msedge.exe	78
PID 3676 wrote to memory of 1568	3676	msedge.exe	79
PID 3676 wrote to memory of 1568	3676	msedge.exe	79
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80
PID 3676 wrote to memory of 3100	3676	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/0s4l0ql101w6f/ROBLOX+EXECUTOR
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe42a13cb8,0x7ffe42a13cc8,0x7ffe42a13cd8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,13706329229414747212,2451155296584920215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4596

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Roblox Executor V2\" -ad -an -ai#7zMap23124:98:7zEvent18508
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1152

C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader V2.exe
"C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader V2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1076
  2⤵
  - Program crash
  PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4928 -ip 4928
1⤵
PID:860

C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader.exe
"C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4152

C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader.exe
"C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4720

C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader V2.exe
"C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader V2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1048
  2⤵
  - Program crash
  PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4176 -ip 4176
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bb4794b7779cd5dcfdf8d7cb84c74ce3

SHA1
fd9fbd596c4ddffa44f40f2307e77141176b9f7c

SHA256
8861f64870c204c6d28a95727cc643c7ca9d6b29a391cef3d09b5b1ab52bff6c

SHA512
55eef339be849767dae887cd986d9cc255638893b5e9d6e78fafb06004bef0d49fa4dd5c0dd4b5fdb7dd4e976e8e0c6aa36843c1f59bbcc1010a58e37042a9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
15b7efbc23ce8745952c1067bda14d19

SHA1
85e29f48cc8f7d64b5d3ff1e6fcfe11bae3b8ee2

SHA256
0b7f73057fe92cff0828dbb6d52233f798bdd360f95a82416845068ff66e1627

SHA512
f0a5c0b1488ebe6660b14d9b18c1219b42eb91dec252adf9cd82b78f054176301e2c27dc4dcf7c414466345632960f0fd58f3617893a37b3b63a5f1e81b6b91b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4fcdc1066c80671c8724411a83307510

SHA1
4bfe27f37506e6f3f048dea15e7e4f1b1da6429a

SHA256
9d5c48af8aad4fcaa7347975a01c84f745bd1b9b3b60ee7b1fc719915a9acf43

SHA512
0f7f8e3cf69b84cd5b81448ac7fa0706a63e5d6d3c5ed65649162a0a6b00fcc8c941711fef41994669ea83b617dc53b5203863efd6d37cc1b47af27e88e6069a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fecd2a4a23b55b5fa0c3307795fb813c

SHA1
7b46febce380844759f9eec43109a09321678deb

SHA256
ed793d24ae0a87d0180cc639cce59a078baff65bda98736c426d61c4e6939dbd

SHA512
0b23088ad1b2a8656c74122b66a9fd4b35643f57c5c67ec73145740b7b8b2a35c0161c4286e490b2daa6236ee4050e9cde9887c963d636c2e786abbc16f6a6b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6230c47c883fe9e6c31dbd8d1448cf30

SHA1
bb3d961d67397df8d48349541e98d6b32856a381

SHA256
020be5b5a433fd50a304e9671394a2cb2be46313d50bc3f666823f45ce408b6c

SHA512
b5327f63f2631cba607dc761766d490f6e2e9175b253be271db24cd7e4a95f54c37075aef20b99d1bd3d8df0767c1bbe0b6edeea04fb43380df4dbc5a5f75da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
18d63066c81e71a78f0aa0668c8ddfcd

SHA1
726f444f550efd7d3229f0eb1cc6977634eb6bbd

SHA256
704a1ebf3ee2d9ded186e0757911ef49e19fa10ce8114039acbb14348f885b37

SHA512
282f47b8f0f6c2f332f37a09acabf0f06d72fa41f39a928f5c21c798318ce7eaa225c5ce646ce4a1ed385eb05fda7134fc840a4e7c73e9327bec7a18738c2bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fdf7.TMP

Filesize
48B

MD5
af84adbe6d18449faaf128414847db01

SHA1
9668bde9c65624a01b6a75267173701072a09a64

SHA256
717068ca8ecd8938d8645555040bf70b3561f973340e5ea1f7550bd46e953b7f

SHA512
1c02e1e19f646656d560c3b1a0316b48f0f3e21cf001ff352406df1ab247ab3d0f62fe86445be93406a51db4737533789b971ed451504a2bb112a682f9bcea0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
510bb993d8edfa606f2c39893c2b8f56

SHA1
9a363b3827902b3552a7a097576fd18b362f4868

SHA256
ed068c568bb7a09aa0b001ba3740d186097db37938e2776518f1d252e4886a96

SHA512
105b4a6b188994d6c4fe3bd9e69ee901bc25a46826d2c860c646d449c27cc2bab08134f3a6531d3f55822cac2971f5721f1b04d6ef4698b88245cdf58e055736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cfb4.TMP

Filesize
1KB

MD5
813d0e9926352c3c62bb94bc8c3dac0d

SHA1
4d50dc25fa83782ef048d07b7aac9ed95a4be30b

SHA256
d855aa7dd743d9dfde0d5c50091cf9a3a0636e467f2a4195e56a9d307bcc0ce5

SHA512
33e9c69172b4d8560af63136e6ba282161aa9c6a5aa61df659876cbd40c08bada44ff402e7382c44a17be62cecb86f1b986590237dae15518ad62087d3e19a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1c240468619fe31d4a0683ad7d9bdd22

SHA1
36d8a1f875390751b0ef5ac0eb0bab360f8def09

SHA256
f54e393aa49849f94b0336e3803d05147c14e28bdcc2ef2ce477226e2bea81a7

SHA512
cc1c98dd65a3e6d31ecc57d211afc332f78490e103266508829c5e7b3ad6cd20fd5abe7125bd878c66627b8c65caf0f9924f6a6a63d175224b7e46d97f947f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c601bbd8bb9068d07db1ed377970bbbe

SHA1
890c2fa9ea86ebf6061adcff10ddd831861b3697

SHA256
65711f79305cb6b40a11f5c8a708743d8759887f91dd2826ad6bebebfcf7807d

SHA512
836946c5d48d83112a15f4cd2a7aac5023034576cd3ff69ced5f5e89a14fe674a8894f7da75808ee30ac832cb3964d423f1963b02cdfc6f1e00bdc6a33d15386

Download Submit
C:\Users\Admin\AppData\Roaming\gdi.dll

Filesize
446KB

MD5
71c87db03cd9a9179b9ff14d2268e577

SHA1
b8b83a653367daf2c3adaa3d96360beb3daf1ba6

SHA256
c29c17ed4f7895c9a0a9b8c9a071886c99440d39a7bde596bc5ebfec0ca9ff66

SHA512
902c92f809f40249acb689fc4b50e546f53737a378684fc89f93d9f752a562c58e985f553f29a134caf5f8e9ad8d10b0c25d6029f29df469fd83a973049dd0c8

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
434KB

MD5
f37d6a7a0114353d68bb6a87e74773cf

SHA1
47566c0ca1dbf49471696fc8a6393a1e235ad874

SHA256
93c98d7f3e72a0ce8d49c9d7fe804c5ce1ae1571f3409739dd06f0ea4523e586

SHA512
3457290fefcb326bd61533f8b97f6c6b3cf81365bdfef3db072125a2cb748d80951e1dbdc3bcfc8dca819ea08c8d4c6b6d358aff02e4ec077e269c6ce1248bb0

Download Submit
C:\Users\Admin\Downloads\Roblox Executor V2.zip

Filesize
17.4MB

MD5
1b287280f091b6d2cf76531298db003e

SHA1
8e58d8ceefa3c617f033a23573939e21d0aa1b2f

SHA256
a969df55ea873573fc6995af3e6182c9dc1d99dff7541957d035d3b6ebce522b

SHA512
3e159973d90e0a8c4fd4dc96cb13d72eb46e102e0c0b6c7a29c20ff6eb3d5242eee90fa9062e6570974420f4d0ab825539dee4e3b16183e41595c0f127922e0c

Download Submit
C:\Users\Admin\Downloads\Roblox Executor V2.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader V2.exe

Filesize
692KB

MD5
2df93f691b753483e3859a79c06452c9

SHA1
f4277dfd88ed91d0c1fba04fa5d2a4df97c4d5d5

SHA256
0f87ddcfcdcc1bcf77a2fc462cac52440e084d4563bbe3b4470e199d765ae4ab

SHA512
3c8239b987753249fddb1d4294425d4fa55f3079e01330b4d391f0eca4818ada461efd93b7a3a676066aff09b301b01bade52f76a5b31f512b4b19188a660406

Download Submit
C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\Loader.exe

Filesize
1.9MB

MD5
cc88d9e31537af9c88da3866d2183c40

SHA1
a4d5c5f80df9b248596eea1bded157fdb518af18

SHA256
b20a9b310f78a4df2094bc1d11bfefbc9593e8e8037fa36eea37746c9f45d601

SHA512
5e51cf247ec65b9f4132a8134d158348c8513d56101d00fe225c23c731caf0227a00e4484bf26badbfcce9753705f38980dd9093f7c7d7b2a3246e8e5adc2da6

Download Submit
C:\Users\Admin\Downloads\Roblox Executor V2\Roblox Executor\WindowsManager.dll

Filesize
446KB

MD5
688153b47e376415b0768fc1076d05fd

SHA1
dd5db86689bec9f174fc20bd03242d9e95dacc7b

SHA256
ca71e2a6f536b800f3e0a1841171616ef3a462646621f5c53dfd5486d00f4d61

SHA512
69e4fcc11ce6f2d54138279bd018f0840fcbb3db25da7d7099151b32133b5c9ca9ed687d744b3c6a883bb8570306149e1dec98b9d8008620ba18b7300c22d96b

Download Submit
memory/1004-1211-0x0000000001180000-0x00000000011E6000-memory.dmp

Filesize
408KB

Download
memory/1004-1214-0x0000000001180000-0x00000000011E6000-memory.dmp

Filesize
408KB

Download
memory/3200-1163-0x00000000003A0000-0x0000000000406000-memory.dmp

Filesize
408KB

Download
memory/3200-1167-0x00000000003A0000-0x0000000000406000-memory.dmp

Filesize
408KB

Download
memory/3200-1164-0x00000000003A0000-0x0000000000406000-memory.dmp

Filesize
408KB

Download
memory/4152-1181-0x00000000008C0000-0x0000000000925000-memory.dmp

Filesize
404KB

Download
memory/4152-1178-0x00000000008C0000-0x0000000000925000-memory.dmp

Filesize
404KB

Download
memory/4152-1177-0x00000000008C0000-0x0000000000925000-memory.dmp

Filesize
404KB

Download
memory/4720-1190-0x00000000006F0000-0x0000000000755000-memory.dmp

Filesize
404KB

Download
memory/4720-1193-0x00000000006F0000-0x0000000000755000-memory.dmp

Filesize
404KB

Download
memory/4928-1155-0x0000000000160000-0x0000000000216000-memory.dmp

Filesize
728KB

Download
memory/4928-1156-0x00000000024D0000-0x00000000024D6000-memory.dmp

Filesize
24KB

Download