Overview
overview
5Static
static
1version-2f...er.exe
windows7-x64
1version-2f...er.exe
windows10-2004-x64
1version-2f...ta.dll
windows7-x64
1version-2f...ta.dll
windows10-2004-x64
5version-2f...ta.exe
windows7-x64
1version-2f...ta.exe
windows10-2004-x64
5version-2f...er.dll
windows7-x64
1version-2f...er.dll
windows10-2004-x64
1version-2f...ler.js
windows7-x64
3version-2f...ler.js
windows10-2004-x64
3Analysis
-
max time kernel
138s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 23:32
Static task
static1
Behavioral task
behavioral1
Sample
version-2f99b302154c4478/RobloxCrashHandler.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
version-2f99b302154c4478/RobloxCrashHandler.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
version-2f99b302154c4478/RobloxPlayerBeta.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
version-2f99b302154c4478/RobloxPlayerBeta.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
version-2f99b302154c4478/RobloxPlayerBeta.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
version-2f99b302154c4478/RobloxPlayerBeta.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
version-2f99b302154c4478/WebView2Loader.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
version-2f99b302154c4478/WebView2Loader.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
version-2f99b302154c4478/content/configs/PerformanceConfigs/rofiler.js
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
version-2f99b302154c4478/content/configs/PerformanceConfigs/rofiler.js
Resource
win10v2004-20240508-en
General
-
Target
version-2f99b302154c4478/RobloxPlayerBeta.exe
-
Size
87.1MB
-
MD5
9df96115b99e6b6e4b7a27e8810032de
-
SHA1
9a40772189129e2c782ffe9d024cfd69310b488d
-
SHA256
cf9c3426724b5219949d59cda4fab86294ad95769562cf882a6d31f97501a607
-
SHA512
906400f9d76b2717b653c4e054db5e91bd4a0e70584f21447b8ccbc8a9b176fc48247affd05c4543185842dbed93b93bff928b59aea4b94b6a7afa0b88d6ec48
-
SSDEEP
1572864:Tf2eZ40m1pCicEYeqhHF8kxd7Q6870H7kPwwrEBjxUUn6nRdYgx:TdxIpCiFu5F8kxJJG0H4Pw0EBjxNu
Malware Config
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 5112 RobloxPlayerBeta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5112 RobloxPlayerBeta.exe 5112 RobloxPlayerBeta.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 5112 RobloxPlayerBeta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\version-2f99b302154c4478\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Temp\version-2f99b302154c4478\RobloxPlayerBeta.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:5112