b8fc426537ccf7adee29814cf6b80c553d3088dbf4881af1eb6aba3110133548

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
txt.exe
Size 1.4MB
Sample261002-j9nfmassds
SHA256 b8fc426537ccf7adee29814cf6b80c553d3088dbf4881af1eb6aba3110133548
MD5 6537601108b2cd91478fbb777c2fc8f0
SHA1 50e60406bbf19ea28a234590408ed768e668616d
SHA512 0a663fd5ee1dcbb2d45c33b363dbbc28516050e9180cfa55aa7505c6720b75692cdee565351bc86346fd4dfe14b5a38e028af094990ce5260117b955e64fe771
SSDEEP 24576:nRBg6b2VW3kIUUENDZx2jSBGxuvkIUUENOJGrpAHORXUziWV0wzdHg:TgwVU1h2jCVU1YGpRXUtLzdHg
TLSH
T14765130031F09A37E0F546355EA76B720376BD119F398A4AD948FA4E25317B49F3E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\Desktop\robuxdownloadder.exe = "C:\\Users\\Admin\\Desktop\\robuxdownloadder.exe:*:Enabled:Microst Windows Explorer"	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\:\Users\Admin\Desktop\robuxdownloadder.exe = ":\\Users\\Admin\\Desktop\\robuxdownloadder.exe:*:Enabled:Microst Windows Explorer"	robuxdownloadder.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	txt.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	txt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	txt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	robuxdownloadder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	robuxdownloadder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	robuxdownloadder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	robuxdownloadder.exe

Executes dropped EXE 4 IoCs

pid	Process
5312	robuxdownloadder.exe
4700	robuxdownloadder.exe
2452	robuxdownloadder.exe
3648	robuxdownloadder.exe

Loads dropped DLL 3 IoCs

pid	Process
4568	txt.exe
4700	robuxdownloadder.exe
3648	robuxdownloadder.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer.exe = "C:\\Users\\Admin\\Desktop\\robuxdownloadder.exe"	txt.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\f:\	robuxdownloadder.exe
\??\f:\	robuxdownloadder.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	txt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	robuxdownloadder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	robuxdownloadder.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robuxdownloadder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robuxdownloadder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robuxdownloadder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robuxdownloadder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txt.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\icpijlcurpf = "lB\x7fCHxtCjwo{BNK[Evciu"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRmnZM`qwIgpTI"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRn^ZM`qwObZ}\x7f"	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\ysKaoqzz = "_BFPR`vujKQJQex^VjGpd~kJs"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\icpijlcurpf = "lB\x7fCHxtBjwo{BNKKEvciu"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRg~ZM`qwZD[Ry"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRmNZM`qvisLUs"	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\icpijlcurpf = "lB\x7fCHxtAjwo{BNKKEvciu"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gQfAlmxyknaB = "pXeB}@\|C\\yOSTrs][ymV\\"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRcnZM`qvN[ERX"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRoNZM`qv\x7fAd~w"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRo~ZM`quo_N\x7fp"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRg^ZM`qvpg_bO"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRo^ZM`qtOKr~J"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRnnZM`qt_\|p\|x"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRiNZM`qw\|vm\x7fg"	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\hHdw = "SyCGWyzY_}ml@CVPAn\\ql"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\wkeJRI = "mzpuEmtHJCoFJrZYq[lVK"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRa~ZM`qwcTstp"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmR`nZM`qvSwMwx"	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\ysKaoqzz = "_BFPR`vujKQJQex^VjGpd~kJp"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\icpijlcurpf = "lB\x7fCHxtCjwo{BNKKEvciu"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmR`~ZM`qtc}[wE"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRnNZM`qu\x7fhL}B"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRh^ZM`qvLUS\|o"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRb~ZM`qw~x{QP"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\icpijlcurpf = "lB\x7fCHxtCjwo{BNJwEvciu"	robuxdownloadder.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRf~ZM`qu`JRvU"	robuxdownloadder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	txt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	txt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRc~ZM`qt~QSRe"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRbNZM`qtnfQPW"	robuxdownloadder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{617E50F1-26EE-358A-9A32-9B32A55D49A5}\gntZvqyvrsAnn = "my_MEULppmRhNZM`qt\|_E\|R"	robuxdownloadder.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\TEMP:3E9B0E7B	robuxdownloadder.exe
File opened for modification	C:\ProgramData\TEMP:3E9B0E7B	robuxdownloadder.exe
File created	C:\ProgramData\TEMP:3E9B0E7B	robuxdownloadder.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4700	robuxdownloadder.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: 33	4568	txt.exe
Token: SeIncBasePriorityPrivilege	4568	txt.exe
Token: 33	4568	txt.exe
Token: SeIncBasePriorityPrivilege	4568	txt.exe
Token: 33	4700	robuxdownloadder.exe
Token: SeIncBasePriorityPrivilege	4700	robuxdownloadder.exe
Token: 33	4700	robuxdownloadder.exe
Token: SeIncBasePriorityPrivilege	4700	robuxdownloadder.exe
Token: 33	3648	robuxdownloadder.exe
Token: SeIncBasePriorityPrivilege	3648	robuxdownloadder.exe
Token: 33	3648	robuxdownloadder.exe
Token: SeIncBasePriorityPrivilege	3648	robuxdownloadder.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4568	txt.exe
4700	robuxdownloadder.exe
4700	robuxdownloadder.exe
3648	robuxdownloadder.exe
3648	robuxdownloadder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 260 wrote to memory of 4568	260	txt.exe	88
PID 4568 wrote to memory of 5312	4568	txt.exe	89

C:\Users\Admin\AppData\Local\Temp\txt.exe
"C:\Users\Admin\AppData\Local\Temp\txt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260
- C:\Users\Admin\AppData\Local\Temp\txt.exe
  "C:\Users\Admin\AppData\Local\Temp\txt.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\Desktop\robuxdownloadder.exe
    "C:\Users\Admin\Desktop\robuxdownloadder.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5312
  - - C:\Users\Admin\Desktop\robuxdownloadder.exe
      "C:\Users\Admin\Desktop\robuxdownloadder.exe"
      4⤵
      Modifies firewall policy service
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      NTFS ADS
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4700

C:\Users\Admin\Desktop\robuxdownloadder.exe
C:\Users\Admin\Desktop\robuxdownloadder.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452
- C:\Users\Admin\Desktop\robuxdownloadder.exe
  C:\Users\Admin\Desktop\robuxdownloadder.exe
  2⤵
  - Modifies firewall policy service
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

TEMP:3E9B0E7B

Path C:\ProgramData\TEMP:3E9B0E7B
Size 110B
SHA256 9b8b04c5a73c29686d4bd085ac4ff82aefeb92469e2c113cd8a8b3881695c537
MD5 87aa32bea76fed9d60158bd79c933bf7
SHA1 dd29d498b4c6d2fada58d5ff9ce91e1a17b35b30
SHA512 f7b7c450dcdbe6a97c83d35af9044db3530e1c686dbaddf510c07b27037281fdaa13e9c05a6e92d89120e814846ca84156e5f0d05674cc01ed810d65d8af77dd
TLSH
T15EB092A09E7CC91E58523AA4E586D2AB1A986E3921640476E0562E708E822789840276
MD5 SHA1 SHA512 TLSH

Submit Download

TEMP:3E9B0E7B

Path C:\ProgramData\TEMP:3E9B0E7B
Size 110B
SHA256 9cf99b7462f2dc9cb670e94ce3c75199266e078f95a3a183c1734086b4203906
MD5 b620ed3c0d1ba22e88d7a96f971fec7b
SHA1 28e9b2429f5a841c591b1131413bb1b0d66c5327
SHA512 f312aa3107337e27cdd17e35ea05314f39b0b689d8ed7b6ddd7a9f4ef1ba1889b91d1f055d52db3185a287fb51312fb07e907009099f19582e9c462ac7714d71
TLSH
T19CB092A0DEBD891A59423AA4A5C7D1AB2B9C2E39264414B6E0562F308986278940027A
MD5 SHA1 SHA512 TLSH

Submit Download

TEMP:3E9B0E7B

Path C:\ProgramData\TEMP:3E9B0E7B
Size 110B
SHA256 bba3243d80322b6c79a55e195636b08f44a3ec152b153107a6ae846f2a32c498
MD5 27b94786c53244b20c047668136905d2
SHA1 2a2cd01238c805c22519d86ded2355671ffb66d8
SHA512 47353758a0456a100b1c18bb1b65755104f1c2ec8b1c5157c3ef55e02dd8eb1df824fec3446e77697d5175966517ad32292dd59693cb7acdec11f6ebe4d7d234
TLSH
T1EDB012A0DE7C991E58933AB4E1C7D29F1F9C6E3A364404B7E0667E70CD8327C5500276
MD5 SHA1 SHA512 TLSH

Submit Download

TEMP:3E9B0E7B

Path C:\ProgramData\TEMP:3E9B0E7B
Size 110B
SHA256 162aa6bd60d72e1df6d08ba77d9c23b83a5904b9ab3b83d06bc7a0130b0ecea7
MD5 b1bffecf2b840ecb2d8e430cccf6b9ba
SHA1 736cf0ef4deb0bf1018491d9e5752807eef23aff
SHA512 8c9f1f46bb7f23fbd1158c09ba34b8db4f1201c9da2fddd1897ab3c02e6707727f882a65c64fa61a2e59609773490bbac63413eab541be9136556370314d1987
TLSH
T14CB092A0AE7C891A58823AA4E9D6E19B1A986E3A21440476A0562E3089832785400276
MD5 SHA1 SHA512 TLSH

Submit Download

TEMP:3E9B0E7B

Path C:\ProgramData\TEMP:3E9B0E7B
Size 110B
SHA256 28bd5f09504854f72dc244dcceb589bb865e3b503aa6bf7932525085c0fa4527
MD5 5ceb8d7cc39d996df3412afd09c39fff
SHA1 7eb7af7f9b011c0dc56efb372e8f20f779faffa5
SHA512 6b0169a37b5180fad10f1da6659240e022f159a8bb046f8e217a2f7bc17e6cca5c6a03526c909d7e437ec27cb89c9da5ab348ce9646f82bd5cb731e9628ea78b
TLSH
T1D3B092906EBC891D68823AA490CBE56B1AA8AD352148147691A66E30DD932789081576
MD5 SHA1 SHA512 TLSH

Submit Download

robuxdownloadder.exe

Path C:\Users\Admin\Desktop\robuxdownloadder.exe
Size 772KB
SHA256 e5e786cb7d418b3e2812752e21f72883067b93a35eb08e7c78994e27a299153d
MD5 c8fd347d0aa0ca1bc65b2ba90d55d494
SHA1 ef4c8c615c3b6cc8e45cc623a700320d49e73a59
SHA512 c8d80a234b12a316f0b86c0ddba02aa816927eb90fab362699ff3b6930e1e1155a77222f445160335c88618b77be79954fba0df773e8003f736fa2e4a044e6ea
SSDEEP 12288:OS0lZ3B2jhu6fSBPOjNNMvkIUGxHkNOwWGrD11yoOOXwD9ARXUz5gidjbPu:kZx2jSBGxuvkIUUENOJGrpAHORXUziW
TLSH
T15FF423490470AD6BD478857DAED77B320132BA819F6D66446C88FF8F31187B44F6B788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntuser.dt

Path C:\Users\Admin\ntuser.dt
Size 808B
SHA256 a36ca97d10f404fe4f545f662e90f43314c4a6c5ed18a05eb7ad036d5a2b037c
MD5 cc17e2a64413c8dd98df3189f989e95c
SHA1 b18b4f06385631fca233add3160b93b2f2ea2b0f
SHA512 d87784c18e849133dead4dd12a5c84b01d388b226a10401d13fda8ad1ba4643fb72d01e3ae38069f733b69cd95c7a3126a1e2cfc25ecd646d4ff699678fac4f7
TLSH
T14301AB5FD3F39DE50BDDBD6B966237DC1A82148F98262D8BE92B893804CB54054C910C
MD5 SHA1 SHA512 TLSH

Submit Download

MSWINSCK.OCX

Path C:\Windows\SysWOW64\MSWINSCK.OCX
Size 105KB
SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
MD5 9484c04258830aa3c2f2a70eb041414c
SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
TLSH
T1A8B35C02B3E58171E5F22B300A361B61AFBEBD25AD31864BC354765D1E31B95EE3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-0-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/260-48-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/260-2-0x0000000000471000-0x0000000000472000-memory.dmp

Download

memory/260-20-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/260-21-0x0000000000471000-0x0000000000472000-memory.dmp

Download

memory/2452-96-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/3648-82-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/3648-81-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/3648-72-0x0000000000730000-0x0000000000786000-memory.dmp

Download

memory/3648-83-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/3648-84-0x0000000000730000-0x0000000000786000-memory.dmp

Download

memory/3648-91-0x0000000000730000-0x0000000000786000-memory.dmp

Download

memory/3648-95-0x0000000000730000-0x0000000000786000-memory.dmp

Download

memory/4568-13-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4568-11-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4568-7-0x0000000002110000-0x0000000002166000-memory.dmp

Download

memory/4568-15-0x0000000002110000-0x0000000002166000-memory.dmp

Download

memory/4568-41-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4568-14-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4568-22-0x0000000002110000-0x0000000002166000-memory.dmp

Download

memory/4568-43-0x0000000002110000-0x0000000002166000-memory.dmp

Download

memory/4568-12-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4568-5-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4568-3-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4568-18-0x0000000002110000-0x0000000002166000-memory.dmp

Download

memory/4700-105-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-131-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-65-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/4700-86-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-66-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-61-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/4700-56-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/4700-46-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/4700-99-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-100-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-103-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-51-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-107-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-108-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-109-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-50-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/4700-114-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-116-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-117-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-118-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-119-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-122-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-124-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-125-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-127-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-128-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-129-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-64-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/4700-133-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-135-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-136-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-137-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-140-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-142-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-143-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-144-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-145-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-146-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-148-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-150-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-178-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-161-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-163-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-162-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-165-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-168-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-167-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-169-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-170-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-174-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-177-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/4700-176-0x0000000002240000-0x0000000002296000-memory.dmp

Download

memory/5312-40-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/5312-98-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/5312-42-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads