General
- Target Roblox.Account.Manager.3.7.2.zip
- Size 4.2MB
- Sample260627-reet1abx7n
- SHA256 49b2c015da0851a2ed43820799a7bcda08e1bc5f315e107598f87f4b1bd36dac
Malware Config
Targets
-
- Target Roblox Account Manager.exe
- Size 5.4MB
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
- Target cefsharp.core.dll
- Size 920KB
- SHA256 cec6e0403a2dafea012ee965921f44657caec0f07e813b8f7d259d90351cb8b0
Score1/10 -
- Target cefsharp.pdb
- Size 1.0MB
- SHA256 c28dc55559a712ac69b7c3c7bb3b3189f7f23b05382d36e24524d7396ada2f9f
Score3/10 -
- Target cefsharp.winforms.pdb
- Size 151KB
- SHA256 2468af2e71ec637d867064b6096c88da66a1478bdf59503bfca05a4f0142b3cd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
Score3/10 -
- Target fastcoloredtextbox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
Score1/10 -
- Target icsharpcode.sharpziplib.pdb
- Size 118KB
- SHA256 d14d75b91138cfda95c8396752c4935fbe8afdad12e026c0845899b460bf555e
Score3/10 -
- Target log4net.dll
- Size 264KB
- SHA256 4ffeecfa1564bcd632891c7e0f376669227ed177e4f34bd8fb25f493162d8c3a
Score1/10 -
- Target microsoft.aspnetcore.webutilities.dll
- Size 64KB
- SHA256 0f96a425e05decd3484eecc05f1957ef39768dfb1ce2e4cac9e10ac30361aa8a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target microsoft.extensions.dependencyinjection.abstractions.dll
- Size 62KB
- SHA256 c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e
Score1/10 -
- Target microsoft.extensions.logging.abstractions.dll
- Size 66KB
- SHA256 5907c585797617c998df0953d2a05d334a9d80f04a5c0bc20377725327e3355d
Score1/10 -
- Target microsoft.extensions.options.dll
- Size 67KB
- SHA256 c9b11d696d9cfd6276dbb057fa9ed0787af16889e7ce0964460de9eea7cce8dd
Score1/10 -
- Target microsoft.extensions.primitives.dll
- Size 48KB
- SHA256 3c6ea55594433e2f0340227bd1588fbab1ba8a10c99319b528cc5573259340cb
Score1/10 -
- Target microsoft.net.http.headers.dll
- Size 73KB
- SHA256 751e6493e6e4ec1951f9cd7b912388979ca54ef33ecfaf1c38654e0b87a13993
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target microsoft.windowsapicodepack.dll
- Size 96KB
- SHA256 808e96f59e7dd2212eace049079d25545f6c9c3f05244ec9cdc539fda18d34d6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target newtonsoft.json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1