Analysis
- max time kernel
149s - max time network
135s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
30/05/2026, 16:11
General
- Target Roblox Cheat by zynqo.exe
- Size 40.5MB
- Sample260530-tm2pvaby8k
- SHA256 8e8b0cfe0a1730fb4ddaabee88c7ad2a75843c95c3119b56431d8ed6eeab028d
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 61 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Detects Pyinstaller 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Cheat by zynqo.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Cheat by zynqo.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Roblox Cheat by zynqo.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Cheat by zynqo.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac /fo csv /nh"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\getmac.exegetmac /fo csv /nh4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\53de26af-160d-46c4-b62c-420e6fbf967e.exeC:\Users\Admin\AppData\Local\Temp\53de26af-160d-46c4-b62c-420e6fbf967e.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53de26af-160d-46c4-b62c-420e6fbf967e.exeC:\Users\Admin\AppData\Local\Temp\53de26af-160d-46c4-b62c-420e6fbf967e.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
53de26af-160d-46c4-b62c-420e6fbf967e.exe
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.dll
python314.dll
select.pyd
unicodedata.pyd
81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
base_library.zip
pyexpat.pyd
sqlite3.dll
memory/4716-285-0x0000021050640000-0x0000021050D34000-memory.dmp
memory/4716-288-0x0000021050640000-0x0000021050D34000-memory.dmp