Analysis
-
max time kernel
1797s -
max time network
1798s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
01-07-2024 16:33
Behavioral task
behavioral1
Sample
RobloxCheat.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
RobloxCheat.exe
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
RobloxCheat.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
RobloxCheat.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RobloxCheat.exe
Resource
win11-20240611-en
General
-
Target
RobloxCheat.exe
-
Size
61KB
-
MD5
1173330bc76af605137db64a6377f523
-
SHA1
09713c6e32cc1304dcb40604a1695d7830ceffe3
-
SHA256
f9893dff26df005089614d3b3f3de8b9a9b1a67cd2081345c1973f420350eac7
-
SHA512
57baf32951fb5f23758154eee655773de8d1a11552a97ea8bf52368c2d8d4869ef410ed76f29575aebb09e5454bd5844863fbdeb05952f2b0e76091712b32b24
-
SSDEEP
1536:oHdD3qptlFkbr9H8pV2Vi6lMVOElJJuJXc:Kxq3kbrx8pMVeOElJcJM
Malware Config
Extracted
xworm
amount-acceptance.gl.at.ply.gg:7420
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral5/memory/3900-1-0x0000000000AF0000-0x0000000000B06000-memory.dmp family_xworm C:\ProgramData\svchost.exe family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3968 powershell.exe 224 powershell.exe 4168 powershell.exe 1176 powershell.exe -
Drops startup file 2 IoCs
Processes:
RobloxCheat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk RobloxCheat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk RobloxCheat.exe -
Executes dropped EXE 30 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 4960 svchost.exe 4456 svchost.exe 1716 svchost.exe 1972 svchost.exe 2488 svchost.exe 1096 svchost.exe 4312 svchost.exe 5060 svchost.exe 1916 svchost.exe 3332 svchost.exe 224 svchost.exe 708 svchost.exe 3856 svchost.exe 3872 svchost.exe 1404 svchost.exe 1976 svchost.exe 3700 svchost.exe 2488 svchost.exe 3640 svchost.exe 3696 svchost.exe 1620 svchost.exe 536 svchost.exe 1532 svchost.exe 2760 svchost.exe 4672 svchost.exe 4636 svchost.exe 2236 svchost.exe 4440 svchost.exe 3676 svchost.exe 5048 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RobloxCheat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe" RobloxCheat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3968 powershell.exe 3968 powershell.exe 224 powershell.exe 224 powershell.exe 4168 powershell.exe 4168 powershell.exe 1176 powershell.exe 1176 powershell.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
RobloxCheat.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 3900 RobloxCheat.exe Token: SeDebugPrivilege 3968 powershell.exe Token: SeDebugPrivilege 224 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeDebugPrivilege 3900 RobloxCheat.exe Token: SeDebugPrivilege 4960 svchost.exe Token: SeDebugPrivilege 4456 svchost.exe Token: SeDebugPrivilege 1716 svchost.exe Token: SeDebugPrivilege 1972 svchost.exe Token: SeDebugPrivilege 2488 svchost.exe Token: SeDebugPrivilege 1096 svchost.exe Token: SeDebugPrivilege 4312 svchost.exe Token: SeDebugPrivilege 5060 svchost.exe Token: SeDebugPrivilege 1916 svchost.exe Token: SeDebugPrivilege 3332 svchost.exe Token: SeDebugPrivilege 224 svchost.exe Token: SeDebugPrivilege 708 svchost.exe Token: SeDebugPrivilege 3856 svchost.exe Token: SeDebugPrivilege 3872 svchost.exe Token: SeDebugPrivilege 1404 svchost.exe Token: SeDebugPrivilege 1976 svchost.exe Token: SeDebugPrivilege 3700 svchost.exe Token: SeDebugPrivilege 2488 svchost.exe Token: SeDebugPrivilege 3640 svchost.exe Token: SeDebugPrivilege 3696 svchost.exe Token: SeDebugPrivilege 1620 svchost.exe Token: SeDebugPrivilege 536 svchost.exe Token: SeDebugPrivilege 1532 svchost.exe Token: SeDebugPrivilege 2760 svchost.exe Token: SeDebugPrivilege 4672 svchost.exe Token: SeDebugPrivilege 4636 svchost.exe Token: SeDebugPrivilege 2236 svchost.exe Token: SeDebugPrivilege 4440 svchost.exe Token: SeDebugPrivilege 3676 svchost.exe Token: SeDebugPrivilege 5048 svchost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
RobloxCheat.exedescription pid process target process PID 3900 wrote to memory of 3968 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 3968 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 224 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 224 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 4168 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 4168 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 1176 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 1176 3900 RobloxCheat.exe powershell.exe PID 3900 wrote to memory of 3532 3900 RobloxCheat.exe schtasks.exe PID 3900 wrote to memory of 3532 3900 RobloxCheat.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxCheat.exe"C:\Users\Admin\AppData\Local\Temp\RobloxCheat.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RobloxCheat.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RobloxCheat.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeFilesize
61KB
MD51173330bc76af605137db64a6377f523
SHA109713c6e32cc1304dcb40604a1695d7830ceffe3
SHA256f9893dff26df005089614d3b3f3de8b9a9b1a67cd2081345c1973f420350eac7
SHA51257baf32951fb5f23758154eee655773de8d1a11552a97ea8bf52368c2d8d4869ef410ed76f29575aebb09e5454bd5844863fbdeb05952f2b0e76091712b32b24
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.logFilesize
654B
MD52cbbb74b7da1f720b48ed31085cbd5b8
SHA179caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD52e8eb51096d6f6781456fef7df731d97
SHA1ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA25696bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
SHA5120a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5051a74485331f9d9f5014e58ec71566c
SHA14ed0256a84f2e95609a0b4d5c249bca624db8fe4
SHA2563f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888
SHA5121f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e1406e40bc90234838ab278843448a11
SHA17e056692cfcf53a92ba8582a5fc0d2a418ef0c81
SHA256fdc53165753f599dd5a22b0bd229f8e4c63e73dc47aece0b475c79a7255b1d10
SHA5128ada81e44b16bfca0141dfe52a0b63e3cc7827b8dc45bfea87f834ffb759eeac87426c722b75fd76a447ab5efb69e0053b9fb34bd42d40b413a48f702eb70ab7
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvav251h.han.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3900-1-0x0000000000AF0000-0x0000000000B06000-memory.dmpFilesize
88KB
-
memory/3900-0-0x00007FFA1FC63000-0x00007FFA1FC65000-memory.dmpFilesize
8KB
-
memory/3900-57-0x00007FFA1FC60000-0x00007FFA20722000-memory.dmpFilesize
10.8MB
-
memory/3900-53-0x00007FFA1FC60000-0x00007FFA20722000-memory.dmpFilesize
10.8MB
-
memory/3968-11-0x00007FFA1FC60000-0x00007FFA20722000-memory.dmpFilesize
10.8MB
-
memory/3968-17-0x00007FFA1FC60000-0x00007FFA20722000-memory.dmpFilesize
10.8MB
-
memory/3968-16-0x00007FFA1FC60000-0x00007FFA20722000-memory.dmpFilesize
10.8MB
-
memory/3968-13-0x00007FFA1FC60000-0x00007FFA20722000-memory.dmpFilesize
10.8MB
-
memory/3968-12-0x00007FFA1FC60000-0x00007FFA20722000-memory.dmpFilesize
10.8MB
-
memory/3968-2-0x0000015470D90000-0x0000015470DB2000-memory.dmpFilesize
136KB