Analysis
-
max time kernel
52s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 16:09
Static task
static1
Behavioral task
behavioral1
Sample
RobloxExecutor.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
RobloxExecutor.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
RobloxExecutor.exe
Resource
win10v2004-20240508-en
General
-
Target
RobloxExecutor.exe
-
Size
316KB
-
MD5
f0c864fee64edd613b413ddb7c559446
-
SHA1
87e75a58eef9f3765a2eed498f6aca135b1ef7c4
-
SHA256
f20df849f7284d15b7915badc28f7afaad9e1a768279ced17db67796f2f883fd
-
SHA512
9c8e90d0a04740ed6e36d886bb13bb9df3b963236eaca0b2fd0db6bfce1d4052761d689d77dcf66c7c07df53295751f0ff8907a8f426ccc4391b365b282bd154
-
SSDEEP
3072:0n2Af+SLiJO+Y7mR9USl6yOiGB3PSQQivLXdn+mvo+vuChrZtwkYZBwOepe4PUe1:1E+yclwQKjdn+WPtYVJIoBfTVRsjbQ2p
Malware Config
Extracted
xworm
5.0
allows-welfare.gl.at.ply.gg:49180
B2qPpHuLCfcwYFiL
-
Install_directory
%AppData%
-
install_file
System.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\RarSFX0\Systemdefault.exe family_xworm behavioral3/memory/3284-11-0x0000000000C30000-0x0000000000C40000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3736 powershell.exe 2784 powershell.exe 2892 powershell.exe 3800 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RobloxExecutor.exeSystemdefault.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation RobloxExecutor.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation Systemdefault.exe -
Drops startup file 2 IoCs
Processes:
Systemdefault.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk Systemdefault.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk Systemdefault.exe -
Executes dropped EXE 2 IoCs
Processes:
Systemdefault.exeLOLPOOP.exepid process 3284 Systemdefault.exe 2392 LOLPOOP.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeSystemdefault.exepid process 3736 powershell.exe 3736 powershell.exe 2784 powershell.exe 2784 powershell.exe 2892 powershell.exe 2892 powershell.exe 3800 powershell.exe 3800 powershell.exe 3284 Systemdefault.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Systemdefault.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3284 Systemdefault.exe Token: SeDebugPrivilege 3736 powershell.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 2892 powershell.exe Token: SeDebugPrivilege 3800 powershell.exe Token: SeDebugPrivilege 3284 Systemdefault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Systemdefault.exepid process 3284 Systemdefault.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
RobloxExecutor.execmd.exeSystemdefault.exedescription pid process target process PID 4036 wrote to memory of 2276 4036 RobloxExecutor.exe cmd.exe PID 4036 wrote to memory of 2276 4036 RobloxExecutor.exe cmd.exe PID 4036 wrote to memory of 2276 4036 RobloxExecutor.exe cmd.exe PID 2276 wrote to memory of 3284 2276 cmd.exe Systemdefault.exe PID 2276 wrote to memory of 3284 2276 cmd.exe Systemdefault.exe PID 2276 wrote to memory of 2392 2276 cmd.exe LOLPOOP.exe PID 2276 wrote to memory of 2392 2276 cmd.exe LOLPOOP.exe PID 2276 wrote to memory of 2392 2276 cmd.exe LOLPOOP.exe PID 3284 wrote to memory of 3736 3284 Systemdefault.exe powershell.exe PID 3284 wrote to memory of 3736 3284 Systemdefault.exe powershell.exe PID 3284 wrote to memory of 2784 3284 Systemdefault.exe powershell.exe PID 3284 wrote to memory of 2784 3284 Systemdefault.exe powershell.exe PID 3284 wrote to memory of 2892 3284 Systemdefault.exe powershell.exe PID 3284 wrote to memory of 2892 3284 Systemdefault.exe powershell.exe PID 3284 wrote to memory of 3800 3284 Systemdefault.exe powershell.exe PID 3284 wrote to memory of 3800 3284 Systemdefault.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxExecutor.exe"C:\Users\Admin\AppData\Local\Temp\RobloxExecutor.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "Systemdefault.exe" & start "" "LOLPOOP.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Systemdefault.exe"Systemdefault.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\Systemdefault.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Systemdefault.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOLPOOP.exe"LOLPOOP.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4456,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5a7cc007980e419d553568a106210549a
SHA1c03099706b75071f36c3962fcc60a22f197711e0
SHA256a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165
SHA512b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD534f595487e6bfd1d11c7de88ee50356a
SHA14caad088c15766cc0fa1f42009260e9a02f953bb
SHA2560f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d
SHA51210976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOLPOOP.exeFilesize
9KB
MD5c9bd5672882c79b5f7977fc3c37dc9b6
SHA190cfa0e99aacd42bd2561cdb218fd618f0ed4b9f
SHA256c6594102d290245d0830cead7f7e3cacf79db881358f001373fcca0d625d0998
SHA5125586496c54c7c33c3e3f1cd6c4e0117b8e34d42846f55aadf22314144e1e27691e8c7fef924386cd5ae01a958d7437ab1a0b6c709ca06f25f6deab82f6171038
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Systemdefault.exeFilesize
40KB
MD52b7216f79728eb5ff4b5553737685a99
SHA1d7f4f41f03485eb76326c75ec2ae0fe53282ebd0
SHA2565a40bff3109b83243b53bf7439dc5e66e29c923363c02d49fa93614c19ce36f5
SHA512b9f4c8e9b5b46785806eb498028e85d2515d743a518c0ecfd9269e8f4cb2351da0bcd9a6bc0e74eabc33e8dd2374bee46566b188d5f4ee49ba3384ece7a54982
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jzawyxj0.gyp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2392-13-0x0000000000D90000-0x0000000000D98000-memory.dmpFilesize
32KB
-
memory/2392-12-0x0000000072BBE000-0x0000000072BBF000-memory.dmpFilesize
4KB
-
memory/2392-17-0x0000000072BB0000-0x0000000073360000-memory.dmpFilesize
7.7MB
-
memory/2392-71-0x0000000072BB0000-0x0000000073360000-memory.dmpFilesize
7.7MB
-
memory/2392-15-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/2392-70-0x0000000072BBE000-0x0000000072BBF000-memory.dmpFilesize
4KB
-
memory/2392-14-0x0000000005B30000-0x00000000060D4000-memory.dmpFilesize
5.6MB
-
memory/2392-16-0x0000000005700000-0x000000000570A000-memory.dmpFilesize
40KB
-
memory/3284-11-0x0000000000C30000-0x0000000000C40000-memory.dmpFilesize
64KB
-
memory/3284-10-0x00007FFF00A53000-0x00007FFF00A55000-memory.dmpFilesize
8KB
-
memory/3284-69-0x00007FFF00A53000-0x00007FFF00A55000-memory.dmpFilesize
8KB
-
memory/3284-18-0x000000001BA30000-0x000000001BA40000-memory.dmpFilesize
64KB
-
memory/3284-72-0x000000001BA30000-0x000000001BA40000-memory.dmpFilesize
64KB
-
memory/3736-19-0x00000279630A0000-0x00000279630C2000-memory.dmpFilesize
136KB