Analysis
- user interaction
yes - max time kernel
120s - max time network
94s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
21/06/2026, 03:42
General
- Target RoBeats.External.exe
- Size 135.6MB
- Sample260621-d9a8eact4x
- SHA256 1868ae34f6701627d1e1835ba432f249448e4efe676c0a9b851d7f3628566984
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RoBeats.External.exe"C:\Users\Admin\AppData\Local\Temp\RoBeats.External.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 21202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5388 -ip 53881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
RoBeats.dll
wpfgfx_cor3.dll
memory/5388-6-0x0000000006FB0000-0x0000000007935000-memory.dmp
memory/5388-9-0x0000000006FB0000-0x0000000007935000-memory.dmp
memory/5388-21-0x0000000006BC0000-0x0000000006CFE000-memory.dmp
memory/5388-13-0x00000000087E0000-0x0000000009679000-memory.dmp
memory/5388-57-0x00000000069A0000-0x00000000069B5000-memory.dmp
memory/5388-81-0x0000000007A30000-0x0000000007B0A000-memory.dmp
memory/5388-93-0x00000000079E0000-0x0000000007A08000-memory.dmp
memory/5388-90-0x00000000079E0000-0x0000000007A08000-memory.dmp
memory/5388-89-0x00000000079A0000-0x00000000079E0000-memory.dmp
memory/5388-86-0x00000000079A0000-0x00000000079E0000-memory.dmp
memory/5388-85-0x0000000007940000-0x0000000007948000-memory.dmp
memory/5388-82-0x0000000007940000-0x0000000007948000-memory.dmp
memory/5388-78-0x0000000007A30000-0x0000000007B0A000-memory.dmp
memory/5388-73-0x0000000006F60000-0x0000000006F71000-memory.dmp
memory/5388-70-0x0000000006F60000-0x0000000006F71000-memory.dmp
memory/5388-69-0x0000000006EF0000-0x0000000006F05000-memory.dmp
memory/5388-66-0x0000000006EF0000-0x0000000006F05000-memory.dmp
memory/5388-65-0x0000000006F20000-0x0000000006F5A000-memory.dmp
memory/5388-62-0x0000000006F20000-0x0000000006F5A000-memory.dmp
memory/5388-61-0x0000000006EB0000-0x0000000006EC3000-memory.dmp
memory/5388-58-0x0000000006EB0000-0x0000000006EC3000-memory.dmp
memory/5388-54-0x00000000069A0000-0x00000000069B5000-memory.dmp
memory/5388-31-0x0000000009680000-0x0000000009E4F000-memory.dmp
memory/5388-53-0x0000000006970000-0x0000000006976000-memory.dmp
memory/5388-50-0x0000000006970000-0x0000000006976000-memory.dmp
memory/5388-49-0x0000000006980000-0x0000000006992000-memory.dmp
memory/5388-46-0x0000000006980000-0x0000000006992000-memory.dmp
memory/5388-37-0x0000000006D00000-0x0000000006D7A000-memory.dmp
memory/5388-42-0x0000000006950000-0x0000000006955000-memory.dmp
memory/5388-41-0x0000000006940000-0x000000000694C000-memory.dmp
memory/5388-38-0x0000000006940000-0x000000000694C000-memory.dmp
memory/5388-35-0x0000000006D00000-0x0000000006D7A000-memory.dmp
memory/5388-29-0x00000000068E0000-0x000000000691C000-memory.dmp
memory/5388-26-0x00000000068E0000-0x000000000691C000-memory.dmp
memory/5388-25-0x00000000068A0000-0x00000000068DD000-memory.dmp
memory/5388-22-0x00000000068A0000-0x00000000068DD000-memory.dmp
memory/5388-10-0x00000000087E0000-0x0000000009679000-memory.dmp
memory/5388-20-0x0000000006BC0000-0x0000000006CFE000-memory.dmp
memory/5388-17-0x00000000069C0000-0x0000000006BBC000-memory.dmp
memory/5388-14-0x00000000069C0000-0x0000000006BBC000-memory.dmp
memory/5388-45-0x0000000006950000-0x0000000006955000-memory.dmp
memory/5388-105-0x0000000007A20000-0x0000000007A29000-memory.dmp
memory/5388-133-0x0000000007F40000-0x0000000007F55000-memory.dmp
memory/5388-138-0x00000000080D0000-0x0000000008100000-memory.dmp
memory/5388-137-0x0000000008080000-0x00000000080CC000-memory.dmp
memory/5388-134-0x0000000008080000-0x00000000080CC000-memory.dmp
memory/5388-130-0x0000000007F40000-0x0000000007F55000-memory.dmp
memory/5388-129-0x0000000007F00000-0x0000000007F36000-memory.dmp
memory/5388-126-0x0000000007F00000-0x0000000007F36000-memory.dmp
memory/5388-125-0x0000000007C00000-0x0000000007C05000-memory.dmp
memory/5388-122-0x0000000007C00000-0x0000000007C05000-memory.dmp
memory/5388-121-0x0000000007EB0000-0x0000000007EC0000-memory.dmp
memory/5388-118-0x0000000007EB0000-0x0000000007EC0000-memory.dmp
memory/5388-117-0x0000000007F70000-0x0000000008015000-memory.dmp
memory/5388-114-0x0000000007F70000-0x0000000008015000-memory.dmp
memory/5388-113-0x0000000007E90000-0x0000000007EAD000-memory.dmp
memory/5388-110-0x0000000007E90000-0x0000000007EAD000-memory.dmp
memory/5388-109-0x0000000007E10000-0x0000000007E85000-memory.dmp
memory/5388-106-0x0000000007E10000-0x0000000007E85000-memory.dmp
memory/5388-102-0x0000000007A20000-0x0000000007A29000-memory.dmp
memory/5388-101-0x0000000007B40000-0x0000000007B64000-memory.dmp
memory/5388-98-0x0000000007B40000-0x0000000007B64000-memory.dmp
memory/5388-94-0x000000000BC00000-0x000000000C37E000-memory.dmp
memory/5388-33-0x0000000009680000-0x0000000009E4F000-memory.dmp
memory/5388-213-0x0000000072370000-0x00000000723D8000-memory.dmp
memory/5388-217-0x0000000072370000-0x00000000723D8000-memory.dmp