Analysis
-
max time kernel
7s -
max time network
7s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/02/2025, 19:50
Behavioral task
behavioral1
Sample
Roblox Generator Accounts v9.2.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Roblox Generator Accounts v9.2.exe
Resource
win10v2004-20250217-en
General
-
Target
Roblox Generator Accounts v9.2.exe
-
Size
19.4MB
-
MD5
fee01815d43711b63af85a2392d85903
-
SHA1
301a9fbfbe0341eee01af30d18208e5b671bdb2c
-
SHA256
a18dbc7e059a5537d02f0409810ca3048144d7cfa5124487bd2e8aaa24274071
-
SHA512
fabbc327ba0137f23a84b15ea615ced3069fabf340796b8dfe8230c2b76bc3dc0291c6d29d76dd9807673e0a08ac718c81bfcd42426dc27d124204826cc84cd7
-
SSDEEP
393216:YLFXlruh2Jp5qC3njkVQ8DOEAeCrGFdgQJBPvE4hyVNDMom:6FXNuh50sQhfIhQ3S
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2308 Roblox Generator Accounts v9.2.exe 2308 Roblox Generator Accounts v9.2.exe 2308 Roblox Generator Accounts v9.2.exe 2308 Roblox Generator Accounts v9.2.exe 2308 Roblox Generator Accounts v9.2.exe 2308 Roblox Generator Accounts v9.2.exe 2308 Roblox Generator Accounts v9.2.exe -
resource yara_rule behavioral1/files/0x000500000001c737-136.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2308 2296 Roblox Generator Accounts v9.2.exe 29 PID 2296 wrote to memory of 2308 2296 Roblox Generator Accounts v9.2.exe 29 PID 2296 wrote to memory of 2308 2296 Roblox Generator Accounts v9.2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Generator Accounts v9.2.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Generator Accounts v9.2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\Roblox Generator Accounts v9.2.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Generator Accounts v9.2.exe"2⤵
- Loads dropped DLL
PID:2308
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5a8b0327931fd2c863693634b3081e6a0
SHA1d66cd78c124e931667b6079d5bc5adf55a644293
SHA2561fa836b3704b29e7ad1ea1b0b457f62aae4435c6a1d745707631552a2f83d5f6
SHA5121b8331ac9b17d3553a5c7b4572f826bb232b339c28f6c9a31a870097c7612587cd1dbe59fe294501ce11cf5bba973d83784108309617b6f7104f2aae8f723961
-
Filesize
11KB
MD5eb4c279c8386d4f30aab6d76feec3e5a
SHA10c611e8f56591f64841b846df7d5c07fd75b55a4
SHA25656bc7d3dd48d9cb209195f71be67d0a90ca929a8d4e6ae5a481f3ab0345da294
SHA5121869b0c843df05ba849e79aa15b25855aa5c2c2e5a932c0de650b83c8abe2371585731b0213061b8f4d781a87b352ad3a09bf8555fcf0f9422a0bcc1a9062781
-
Filesize
14KB
MD5a94626cbc9c0e1b62619a8cf49504ff8
SHA1047e2b1f21f1258242238043143f1d892538bbc3
SHA256a36792281c0aaab929635bb1f40ee3627225e7e35e6a199c188f3f782c7e6c27
SHA512b208602f33f02c92df718e4c009e6e8055e538c9451ef6f9682ce21db5258d799c09f689aae2879470a934b60b4f3d44ea82704933fa40f2ff408cf42bd1c534
-
Filesize
12KB
MD5b16e6798ad40000698a09276961fc2c3
SHA1b5184d9bdb1f5e7cfe17b2ec305c8554362067de
SHA256f8b7122ca5e1d473818940fea4d1155af429463038ba61953908fbbbb7a8d613
SHA512a4737a2236eb35e1b4935a5e333c7f1c51588852a8daf654fd2e7ca6e945e40df9d001394c2f3e3a9d023b8d4e34e9753f6472ed58df245b104623d7dbde7423
-
Filesize
11KB
MD5f0f891d08e0e358327b323b38f3ffca2
SHA1eb20f147c53f86c59603f5edbf60f936f768fb1b
SHA2569c8461929b61e0fd269ce735d699e7e3b6c0159d3e2659f60d681290abf9eac5
SHA51294e13c4d09ff35c2ded7fd2649b3542aade1414f05772e2034af7723f2622e662e8c0bb67e1eb288e230f8ae183d8f1296c2a134b7ae061a452fa3f7423d7694
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
1011KB
MD57e39d82adf5da0b51a968c764e0e15c1
SHA179e75ccde95798f21a34e5650b29dbebe79c1b43
SHA256d67926328a72816d2944d7c88df6ff4bfccd41a9ce39af0309a0639829d0e7fb
SHA5121c58d53c40535f80f482a5f406ef5bf9c2f963b9db5969c37ef47b0c59522a1a9bde3f3589538a7ae7d99d567a43170b384761e572c740010feb86894ce7322a