45d46345af6910f24d308c0240abbbb2c18d912aa82e323606de9ce215c7d8bb

General

Target
RobloxPlayerLauncher.exe
Size 2.0MB
Sample260427-thpjqaew8x
SHA256 45d46345af6910f24d308c0240abbbb2c18d912aa82e323606de9ce215c7d8bb
MD5 db6c5ba8ebfac25ef90a93f576a1828a
SHA1 d5423517d97f40f9f53ae7eea08507c1a8d1574a
SHA512 c3adf173cd183ca8e687aca1e3d21ed6d306dc47cfc0a1173d6a6212314754bd11b3030d0b16ae0dd1f312f140ef8ebf5e4fa5bfa1dd42365197d9656beea13a
SSDEEP 49152:dFSDltZFia18KhM/04OSFTUeaho3mfTjFMwPMQ3dSWzTrb6O:wqa1RhM/04OXTbb
TLSH
T1F1A5AD11F614C035E0A101B1A5BDAFB585ACAE349B7548CB3BC84F6D96606D37A32F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerLauncher.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	RobloxPlayerLauncher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 4320	5992	RobloxPlayerLauncher.exe	81

C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
  C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=333ca2e0e398475715c9f5d4356bdefc4c246d95 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7b0,0x7b4,0x7b8,0x77c,0x7c0,0x136d584,0x136d594,0x136d5a4
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 2KB
SHA256 ce3b38bec18c72f905073058892307dbcd76b39bcf5df4ff5ba69e4b9dd3e5ca
MD5 dc2703d4275f0d883b603b2cc17a68ad
SHA1 bfde0f9b54a35c12255026f3e3232e3aa67869dc
SHA512 97bdf7c35a1c738f41bcafe5b08ef6d174ef802fe90b0581cd3b1896f8dbf36de986cd1086ecb8235929982a6cd29293b7223f8bc4891c9e1e2f4eba333726ae
TLSH
T145412BD2CC6820208A5696267BE4EB733AA5748018E3F05AE8D8E1721CCDEFDE51CD0D
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_6705F5963FB7A51D452812C089BBDCD1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_6705F5963FB7A51D452812C089BBDCD1
Size 727B
SHA256 2ea0362e7f3e4df65ed8af5622f83abe57c1930bdee27999c6cceb02187b2f2a
MD5 c93e05b312d513f7377a6e51e062e498
SHA1 ac19be31525a06c2692899da71bc74779d60d68e
SHA512 7be01151eb3c90dc8986773c8ff710cc9513b45e06bd84d97dfcf025e1f52cb852f7fbd23ce456e13afb7e74ebfea0d90dba502c0f48820a2571a0fed28f2499
TLSH
T1060194539C6F0444FE8944925CFE0A30B09A83C1348E87AB1884218F1C14754F146A1C
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F
Size 484B
SHA256 0eb8b4e6f6a1d5172c968c6d0c7e7f6e86b7914ecd774223cdb78298b1c72f42
MD5 887579a4eb1bd6eb84ce5844da5e4a77
SHA1 397d537f55ddeb464770afff6ac0684f646c4f88
SHA512 ae6ac423317688e0605beb4775b099bd6e8a7dea89bfc857e1976b45f51274f1840dd86fab9e0dc2e0587a44357fd457b1ced49ad7354840d5271b123c4d0256
TLSH
T1EDF0A32431EF021CF03ACD7988D9C566B52AF13334604BBE16D50208AD52E40DC63111
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_6705F5963FB7A51D452812C089BBDCD1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_6705F5963FB7A51D452812C089BBDCD1
Size 488B
SHA256 53845c90f2bad8c3fb0862bbe6a6490f73bbfe27706bf1c7a3db9521973ef5aa
MD5 9624584f671697c4f033405a130331e0
SHA1 8a10099f8fddf335e4aff059dab51345bd867dee
SHA512 abad6f9b76af3f6cbe74798a2795f93749b1b493bae6de3b9a28fe6b7c93d76acee3ecdfbf9627f3974cd8414a6167ed46ef207c0527131f83f850405ca32df1
TLSH
T1EBF0AB7828B8403AE2F3E6F895DCF8A9A829F107353516E911A04546AD03F406C52825
MD5 SHA1 SHA512 TLSH

Submit Download

PCClientBootstrapper[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B2T8R804\PCClientBootstrapper[1].json
Size 16KB
SHA256 99651411e9e82c955f996a35a5157e52ced54cc65946ca6768aff45603a30325
MD5 194908cec53f08431ddaaefa5552ae6c
SHA1 f605cda925c5d2a9a728233f6ac7d5741fbbfa0f
SHA512 0875f12ae5d7668882e11c79e96f60e9208fc79d21de05ce8e26dc2ee4645893e81204690e676ed51c6e0028a3e127dda66ab7d6eafb0f48a3a67e59c675c453
SSDEEP 384:Ccmss/Yv0s4LfACQeAY+3mZPVKsSQ578IIpn+/:jKY85qsd42h
TLSH
T19872A311C61D3DAA52DD427E3203ED133768EBDD82C408667796C69E3FB4145322EACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4320-21-0x00000000006D0000-0x000000000072F000-memory.dmp

Download

memory/5992-20-0x0000000003300000-0x000000000335F000-memory.dmp

Download

memory/5992-68-0x0000000003300000-0x000000000335F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads