Analysis
- user interaction
yes - max time kernel
104s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/05/2026, 23:54
General
- Target Roblox Account Manager.exe
- Size 5.4MB
- Sample260519-3xtxesdz4w
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp"C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{5A258A94-61EE-4DF0-83CA-F13387D0803B}\.cr\vcredist.tmp"C:\Windows\Temp\{5A258A94-61EE-4DF0-83CA-F13387D0803B}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=692 -burn.filehandle.self=696 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{D5703F7A-8EE6-47B2-97E4-36A04F4444C0}\.be\VC_redist.x86.exe"C:\Windows\Temp\{D5703F7A-8EE6-47B2-97E4-36A04F4444C0}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{7178F184-0410-4672-AC3D-2243E9F0BE17} {9BBC42BF-D370-4B2D-A356-1E24F74EBD72} 47405⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Roblox Account Manager.exe.log
RAMTheme.ini
Roblox Account Manager.exe.config
libsodium.dll
log4.config
vcredist.tmp
vcredist.tmp
logo.png
wixstdba.dll
memory/412-6-0x00000000052C0000-0x00000000052DE000-memory.dmp
memory/412-5-0x0000000005280000-0x00000000052A6000-memory.dmp
memory/412-4-0x0000000005390000-0x0000000005422000-memory.dmp
memory/412-0-0x0000000000450000-0x00000000009BC000-memory.dmp
memory/412-3-0x0000000002CA0000-0x0000000002CE6000-memory.dmp
memory/412-2-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/412-1-0x0000000005A60000-0x0000000006004000-memory.dmp
memory/2872-23-0x000000000BCE0000-0x000000000BD80000-memory.dmp
memory/2872-95-0x00000000077F0000-0x000000000780A000-memory.dmp
memory/2872-21-0x000000000B990000-0x000000000B9CA000-memory.dmp
memory/2872-20-0x00000000057F0000-0x0000000005800000-memory.dmp
memory/2872-19-0x00000000057F0000-0x0000000005800000-memory.dmp
memory/2872-17-0x0000000006890000-0x000000000689A000-memory.dmp
memory/2872-16-0x00000000066D0000-0x0000000006744000-memory.dmp
memory/2872-87-0x0000000003190000-0x00000000031E8000-memory.dmp
memory/2872-89-0x00000000074E0000-0x0000000007592000-memory.dmp
memory/2872-93-0x00000000076D0000-0x00000000076F2000-memory.dmp
memory/2872-94-0x0000000007700000-0x00000000077F4000-memory.dmp
memory/2872-22-0x000000000BCB0000-0x000000000BCBA000-memory.dmp
memory/2872-96-0x0000000007810000-0x0000000007818000-memory.dmp
memory/2872-97-0x00000000057F0000-0x0000000005800000-memory.dmp
memory/2872-98-0x00000000057F0000-0x0000000005800000-memory.dmp
memory/2872-99-0x00000000057F0000-0x0000000005800000-memory.dmp
memory/2872-101-0x0000000007C80000-0x0000000007C8A000-memory.dmp
memory/2872-102-0x000000000DB40000-0x000000000DB52000-memory.dmp
memory/2872-295-0x00000000059C0000-0x00000000059D4000-memory.dmp
memory/2872-296-0x0000000005BD0000-0x0000000005C20000-memory.dmp
memory/2872-297-0x00000000059E0000-0x00000000059E8000-memory.dmp
memory/2872-13-0x00000000057F0000-0x0000000005800000-memory.dmp
memory/2872-302-0x000000000F4A0000-0x000000000F7F4000-memory.dmp