Analysis
- user interaction
yes - max time kernel
69s - max time network
71s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 18:45
General
- Target Roblox Account Manager.exe
- Size 5.4MB
- Sample260511-xeef5agx51
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Roblox Account Manager.exe.log
RAMSettings.ini
RAMTheme.ini
Roblox Account Manager.exe.config
log4.config
memory/2472-3-0x0000000005A80000-0x0000000005AC6000-memory.dmp
memory/2472-6-0x0000000005B20000-0x0000000005B3E000-memory.dmp
memory/2472-5-0x0000000005AE0000-0x0000000005B06000-memory.dmp
memory/2472-12-0x0000000001A50000-0x0000000001ACB000-memory.dmp
memory/2472-4-0x0000000005B80000-0x0000000005C12000-memory.dmp
memory/2472-13-0x0000000006570000-0x0000000006B72000-memory.dmp
memory/2472-2-0x0000000005A00000-0x0000000005A10000-memory.dmp
memory/2472-1-0x0000000005FC0000-0x0000000006566000-memory.dmp
memory/2472-0-0x00000000009D0000-0x0000000000F3C000-memory.dmp
memory/2492-23-0x000000000BE50000-0x000000000BE8A000-memory.dmp
memory/2492-34-0x000000000D180000-0x000000000D274000-memory.dmp
memory/2492-21-0x0000000005E80000-0x0000000005E90000-memory.dmp
memory/2492-22-0x0000000005E80000-0x0000000005E90000-memory.dmp
memory/2492-18-0x0000000007320000-0x0000000007394000-memory.dmp
memory/2492-24-0x000000000C470000-0x000000000C47A000-memory.dmp
memory/2492-25-0x000000000C490000-0x000000000C530000-memory.dmp
memory/2492-30-0x000000000CD80000-0x000000000CDD8000-memory.dmp
memory/2492-15-0x0000000005E80000-0x0000000005E90000-memory.dmp
memory/2492-32-0x000000000CE20000-0x000000000CED2000-memory.dmp
memory/2492-33-0x000000000D010000-0x000000000D032000-memory.dmp
memory/2492-19-0x00000000074B0000-0x00000000074BA000-memory.dmp
memory/2492-36-0x000000000D290000-0x000000000D298000-memory.dmp
memory/2492-35-0x000000000D270000-0x000000000D28A000-memory.dmp
memory/2492-37-0x0000000005D10000-0x0000000005D9A000-memory.dmp
memory/2492-38-0x0000000005E70000-0x0000000005E7B000-memory.dmp
memory/2492-39-0x0000000006A10000-0x0000000007012000-memory.dmp
memory/2492-42-0x000000000DBA0000-0x000000000DBB2000-memory.dmp
memory/2492-41-0x000000000D520000-0x000000000D52A000-memory.dmp
memory/2492-208-0x0000000005E80000-0x0000000005E90000-memory.dmp
memory/2492-209-0x0000000005E80000-0x0000000005E90000-memory.dmp
memory/2492-210-0x0000000005D10000-0x0000000005D9A000-memory.dmp
memory/2492-216-0x0000000005D10000-0x0000000005D9A000-memory.dmp