Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3Roblox Acc...er.exe
windows11-21h2-x64
6Roblox Acc...er.exe
windows11-21h2-x64
3Roblox Acc...um.dll
windows11-21h2-x64
3Roblox Acc...re.dll
windows11-21h2-x64
3Roblox Acc...ss.exe
windows11-21h2-x64
3Roblox Acc...me.dll
windows11-21h2-x64
3Roblox Acc...rp.dll
windows11-21h2-x64
1Roblox Acc...lf.dll
windows11-21h2-x64
3Roblox Acc...47.dll
windows11-21h2-x64
3Roblox Acc...GL.dll
windows11-21h2-x64
3Roblox Acc...v2.dll
windows11-21h2-x64
3Roblox Acc...ef.dll
windows11-21h2-x64
3Roblox Acc...er.dll
windows11-21h2-x64
3Roblox Acc...-1.dll
windows11-21h2-x64
3Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/08/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
Roblox Account Manager/RBX Alt Manager.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Roblox Account Manager/Roblox Account Manager.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Roblox Account Manager/libsodium.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Roblox Account Manager/x86/CefSharp.BrowserSubprocess.Core.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Roblox Account Manager/x86/CefSharp.BrowserSubprocess.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Roblox Account Manager/x86/CefSharp.Core.Runtime.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Roblox Account Manager/x86/CefSharp.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
Roblox Account Manager/x86/chrome_elf.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
Roblox Account Manager/x86/d3dcompiler_47.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
Roblox Account Manager/x86/libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
Roblox Account Manager/x86/libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Roblox Account Manager/x86/libcef.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
Roblox Account Manager/x86/vk_swiftshader.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
Roblox Account Manager/x86/vulkan-1.dll
Resource
win11-20240802-en
General
-
Target
Roblox Account Manager/x86/vulkan-1.dll
-
Size
751KB
-
MD5
3663d556e7aa952e132e5cc12a4b0340
-
SHA1
6d7624487296f3233f4bf0388bcc8776dbef2fa9
-
SHA256
97fd0b519aef0c27744f6d528ad99bf39954bf9326a7002e572dc16112e84504
-
SHA512
ac544c9a6eae3580b2fedfc43bda72f6d8b962b9ab4049e977c87defef2eb08f7fee2c2e524fe3ffccce9a068e11aad5bfa3005a375610ca95dded3b0345fe37
-
SSDEEP
12288:P3LOeHxI98G95gB8jD090YVJ9BaW9r6Rk1HXbbN86620:P3LOQxX05gYwTf9B9rCSLbNEX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3652 1304 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4132 wrote to memory of 1304 4132 rundll32.exe 82 PID 4132 wrote to memory of 1304 4132 rundll32.exe 82 PID 4132 wrote to memory of 1304 4132 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager\x86\vulkan-1.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager\x86\vulkan-1.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 4843⤵
- Program crash
PID:3652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1304 -ip 13041⤵PID:2328